https://gdprhub.eu/api.php?action=feedcontributions&user=Juliette+Leportois&feedformat=atomGDPRhub - User contributions [en]2024-03-19T12:11:11ZUser contributionsMediaWiki 1.39.6https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_8393/161/2019&diff=10518Tietosuojavaltuutetun toimisto (Finland) - 8393/161/20192020-06-10T17:14:06Z<p>Juliette Leportois: Created page with "{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Fi..."</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Finland<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoFI.png<br />
|DPA_Abbrevation=Tietosuojavaltuutetun toimisto<br />
|DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland)<br />
<br />
|Case_Number_Name=8393/161/2019<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=tietosuoja.fi<br />
|Original_Source_Link_1=https://tietosuoja.fi/documents/6927448/22406974/P%C3%A4%C3%A4t%C3%B6s+henkil%C3%B6tietojen+k%C3%A4sittelyn+lainmukaisuudesta/60115710-2513-a359-6261-e821818b9ee1/P%C3%A4%C3%A4t%C3%B6s+henkil%C3%B6tietojen+k%C3%A4sittelyn+lainmukaisuudesta.pdf<br />
|Original_Source_Language_1=Finnish<br />
|Original_Source_Language__Code_1=FI<br />
|Original_Source_Name_2=tietosuoja.fi (press release)<br />
|Original_Source_Link_2=https://tietosuoja.fi/artikkeli/-/asset_publisher/tietosuojavaltuutetun-toimiston-seuraamuskollegio-maarasi-hallinnollisen-seuraamusmaksun-useista-puutteista-henkilotietojen-kasittelyssa?_101_INSTANCE_ajcbJYZLUABn_languageId=en_US<br />
|Original_Source_Language_2=English<br />
|Original_Source_Language__Code_2=EN<br />
|Original_Source_Name_3=tietosuoja.fi (press release)<br />
|Original_Source_Link_3=https://tietosuoja.fi/artikkeli/-/asset_publisher/tietosuojavaltuutetun-toimiston-seuraamuskollegio-maarasi-hallinnollisen-seuraamusmaksun-useista-puutteista-henkilotietojen-kasittelyssa?_101_INSTANCE_ajcbJYZLUABn_languageId=en_US<br />
|Original_Source_Language_3=English<br />
|Original_Source_Language__Code_3=EN<br />
<br />
|Type=Investigation<br />
|Outcome=Violation Found<br />
|Date_Decided=26.05.2020<br />
|Date_Published=<br />
|Year=2020<br />
|Fine=72000<br />
|Currency=EUR<br />
<br />
|GDPR_Article_1=Article 5(1)(c) GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR#1c<br />
|GDPR_Article_2=Article 5(2) GDPR<br />
|GDPR_Article_Link_2=Article 5 GDPR#2<br />
|GDPR_Article_3=Article 6(1)(f) GDPR<br />
|GDPR_Article_Link_3=Article 6 GDPR#1f<br />
|GDPR_Article_4=Article 12 GDPR<br />
|GDPR_Article_Link_4=Article 12 GDPR<br />
|GDPR_Article_5=Article 13(2)(d) GDPR<br />
|GDPR_Article_Link_5=Article 13 GDPR#2d<br />
|GDPR_Article_6=Article 13(2)(e) GDPR<br />
|GDPR_Article_Link_6=Article 13 GDPR#2e<br />
|GDPR_Article_7=Article 26 GDPR<br />
|GDPR_Article_Link_7=Article 26 GDPR<br />
|GDPR_Article_8=Article 30 GDPR<br />
|GDPR_Article_Link_8=Article 30 GDPR<br />
|GDPR_Article_9=Article 35 GDPR<br />
|GDPR_Article_Link_9=Article 35 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=Taksi Helsinki<br />
|Party_Link_1=https://www.taksihelsinki.fi/<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
the Finnish DPA (Tietosuojavaltuutetun toimisto) fined Taksi Helsinki € 72,000 for failing to assess the risks and effects of personal data processing before adopting a camera surveillance system that records audio and video in its taxis.<br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
Following the investigations carried out in November 2019 on Taksi Helsinki’s processing, the Tietosuojavaltuutetun toimisto found several serious GDPR violations regarding the processing of customers’ audio and video personal data. <br />
<br />
=== Dispute ===<br />
The Tietosuojavaltuutetun toimisto raised six data protection law issues regarding the processing of both audio and video data which can be summed up as below:<br />
- Does the controller process audio and video data for security purposes in accordance with Article 6(1)(f) GDPR?<br />
- Does the controller process audio and video data in accordance with 5(1)(c) GDPR? <br />
- Does the information provided to data subjects regarding the security camera and the automated decision making process comply with Article 12 GDPR? <br />
- Did the controller identify the actors playing a role in the processing, with respect to Articles 4(7), (8) and Articles 26, 28 GDPR (processor, controller, joint controllership)? <br />
- Did the controller maintain a record of processing activities according to Article 30 GDPR? <br />
- Did the controller perform a data protection impact assessment prior to the implementation for the security camera system, as prescribed under Article 35 GDPR? <br />
<br />
<br />
=== Holding ===<br />
First, the Tietosuojavaltuutetun toimisto decided that the controller was not able to demonstrate that the processing of video and audio data for security purposes complies with Article 5 (1) (a) and Article 6 (1) (f) GDPR. Thus, the controller failed to comply with the accountability principle under Article 5 (2) GDPR.<br />
Second, the data protection authority pointed out that the recording of images and sound in all of the company’s cars did not comply with the principle of data minimisation under Article 5(1)(c) GDPR. The recording of the image would have fit the purposes of safety and the investigation of criminal offences and damages which might have occurred, as claimed by the controller. <br />
Regarding the information to be provided to the data subjects, the data protection authority ruled that several pieces of information were missing, such as the right to lodge a complaint and whether the provision of personal data is a legal or contractual requirement, (Article 13 (2) and (e) GDPR). The authority also stated that there was no link between the controller’s privacy policy and the information about the loyalty program website targeting the consumer. This prevents the data subject from exercising their GDPR rights during the processing, and results in an incomprehensible overview of the processing of personal data by the controller in the context of the automated decision making for the loyalty program. Thus, the authority held that the controller did not comply with Article 12 GDPR. <br />
In identifying the controller or processor, in particular the role of the taxi drivers in the processing at stake, the authority held that Taksi Helsinki did not defined what personal data it processes as a controller. Thus, the authority decided that Taksi Helsinki failed to demonstrate its compliance with Article 26 GDPR. <br />
Furthermore, Article 30 GDPR does not require that a report of the processing activities has to be drawn in a specific form other than in writing. However, a report has to be drawn in a document and cannot only subsist in the privacy statements that the data controller provided. Thus, Taksi Helsinki violated Article 30 GDPR. <br />
Lastly, the authority decided that the controller did not carried out any impact assessment. Thus, the controller breached Article 35 GDPR. <br />
<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.<br />
<br />
<pre><br />
Decisions of the Assistant Data Protection Supervisor and the Sanctions Chamber<br />
Thing<br />
General information on the processing of personal data by Taksi Helsinki Oy (later the registrar)<br />
compliance with the Data Protection Regulation 1<br />
• The security camera surveillance carried out by the controller in taxi cars is<br />
and data minimization<br />
• Transparency in the processing of personal data<br />
• Defining the roles of the actors involved in the processing of personal data<br />
• The controller's obligation to prepare a report on the processing operations, as well as<br />
• The obligation for the controller to carry out a data protection impact assessment.<br />
The Office of the EDPS has started to investigate the matter on his own initiative<br />
after receiving the relevant anonymous notification.<br />
The Office of the Data Protection Officer has asked the controller for clarification of the personal data<br />
processing on 13 November 2019. The controller provided its response to the request for clarification<br />
within the deadline of 12.12.2019. The controller has been asked to complete the report<br />
02.06.2020. The registrar provided the requested supplement on the same day.<br />
The EDPS office has requested further clarification and reserved it for the controller<br />
opportunity to be heard on 13 February 2020. The controller responded to the request for further clarification and<br />
consultation by the deadline of 6.3.2020. The controller was requested<br />
to complete its further study on 16.4.2020. The requested supplement was received<br />
21.04.2020. <br />
The matter has also been clarified by consulting the controller’s website,<br />
information from the mobile app and other publicly available sources.<br />
The Office of the Data Protection Officer has requested clarification from the controller<br />
from the service provider on 9.4.2020, but the request for clarification has not been answered.<br />
Decision of the Assistant EDPS on the breach of the Regulation and his powers<br />
exercise of its remedial powers<br />
Statement received from the controller<br />
1. Legality of security camera surveillance<br />
The controller has stated in its report that it is in compliance with the general data protection<br />
implementation of the principle of legality in accordance with Article 5 (1) (a) of<br />
documenting all uses and their legal bases. The register<br />
According to the controller, the responsible person is responsible for the equivalence of the processing carried out.<br />
and legal basis. Further consent and legitimate interest the controller shall also provide documentation of the legal proceedings.<br />
Trust and process estimates found in other reporting. <br />
The controller has identified camera surveillance as the primary legal basis<br />
in accordance with Article 6 (1) (f) of the General Data Protection Regulation<br />
implementation of the legitimate interests pursued by the controller or a third party.<br />
As regards the requirement of the necessity of a legal basis, the controller submits that the processing<br />
is necessary on the one hand because of the right of the taxi driver and the passenger<br />
personal safety can be ensured by both the taxi driver<br />
to safeguard working conditions. On the other hand, processing is considered necessary after processing<br />
the purpose is to deal with incidents and safety hazards<br />
clarification so that a third party can take legal action or<br />
legitimate interests in defense.<br />
As regards the balancing test for the application of the legitimate interest<br />
the controller states that it passes it clearly, but states that it has not been before<br />
this response has been prepared or documented. In the view of the controller<br />
there is in any case a balance between the interests of the controller and the data subjects<br />
assessed in the decision of the Data Protection Board of 25 February 2002, and not by the controller<br />
has therefore not considered that there is a need for separate additional documentation. <br />
Likewise, the controller submits that the legal status with regard to the type of documentation<br />
required of the controller in such a situation shall be deemed to be so unclear,<br />
the controller could not have been required to perform a balancing test in a documented manner.<br />
Finally, however, the controller states that it will<br />
operate the balancing test without undue delay during the spring of 2020 and<br />
the balance between the interests of the controller and those registered<br />
at regular intervals.<br />
2. Minimization of personal data in connection with security camera surveillance<br />
The controller has stated in its report that it is in compliance with the general data protection<br />
the principle of data minimization in accordance with Article 5 (1) (c) of<br />
documenting all personal data stored in information systems or elsewhere. Re-<br />
the registrar states that it shall ensure that it does not hold the data resources for which it is<br />
has not specified at least one use. The controller shall also<br />
that the responsible person is responsible for the equivalence and reasonableness of the personal data stored;<br />
in relation to the purposes for which the data are used. <br />
The registrar has stated in his report of 12 December 2019 and in the<br />
in the privacy statement of the mass surveillance camera surveillance that it deals with<br />
whose personal data of taxi drivers, staff and motorists' customers are described and<br />
using a sound recording camera surveillance system.<br />
In its reply of 6.3.2020, the controller states, unlike before, that it<br />
processes image data only in the context of its security camera surveillance. The registrar brings<br />
emphasized in its reply that new security cameras with voice recording capability<br />
roit was installed in about half of the taxi cars covered by it in the summer<br />
2019. Likewise, the controller states in his response that the processing of audio data<br />
was a mistake and was never intended to deal with<br />
in the context of security camera surveillance. <br />
The data controller has provided his reply as an annex with a voice recording feature<br />
Security Cameras that require Voice Recording<br />
has been set to “Off” during installation. <br />
In its same reply, the controller stated that on 20 December 2019 it had invited the<br />
cars covered by its service to deactivate audio recording. motorists<br />
has had to use the maintenance of his taxi by 15 January 2020 to remove the audio recording<br />
at the risk of a motorist who failed to perform a maintenance visit being removed from taxi<br />
the scope of this Regulation. Furthermore, the controller has stated that maintenance<br />
that voice recording is switched off for all security cameras and<br />
an add-on has been added to the cameras to prevent future use. <br />
The EDPS Office has tried to find out with the voice recording feature<br />
the accuracy of the information on the installation of cameras equipped with<br />
from the service provider of the holder, but has not received a reply to the request for<br />
background.<br />
According to bulletin 2 published on the registrar's website on 13 November 2019 in its cars<br />
is a recording security camera, some of which records sound and images, some of which are mere images. You-<br />
In a mass bulletin, the registrar states that the security camera is for car security<br />
in order to guarantee. In another published by the registrar on its website on 15.11.2019<br />
in bulletin 3, the controller states that it has been found that some of the cameras have<br />
voice recording on and off. Recording camera surveillance data<br />
on 25 May 202020, the<br />
are processed in cars by a camera and sound recording camera surveillance system<br />
through. 4<br />
The registrar has defined the report it submitted on 12 December 201 in the appendix<br />
in the privacy statement of the security camera<br />
for the purposes of the processing of personal data in the context of the transfer<br />
protection of the property of motorists and drivers, the control of operational processes<br />
prevention of crime and the prevention of<br />
settlement of accidents and damage to cars in the dealership between them and<br />
in their vicinity. In its release of 13 November 2015, the registrar has announced a vote<br />
and image, and some are afraid of image, for the purpose of security cameras.<br />
guaranteeing security. 5<br />
The purposes of the processing have been mentioned by the controller in his subsequent reply<br />
6.3.2020 Ensuring the safety of the taxi driver and the passenger, as well as the<br />
situations and security threats, as well as the controller<br />
compliance with legal obligations when handing over video recordings<br />
to the police.<br />
3. Transparency of processing<br />
3.1. Transparency of processing in the context of security camera surveillance<br />
According to the report provided by the controller, the processing of personal data<br />
visibility in the context of security camera surveillance is firstly ensured by<br />
security camera. The notice is placed in<br />
on the outside and inside of the car and, in the controller's view, on the notices<br />
the data subject is informed of the existence of the security camera even before<br />
and, where appropriate, from the inside. <br />
Aircraft, both exterior and interior, supplied by cars by the controller<br />
The notifications mainly contain information on the formation of the price of a taxi ride.<br />
Toa. At the bottom left of the message there is a black message text regarding the<br />
safety cameras: “Car security camera. Registrar Taxi Hel-<br />
zinc Oy. There is a surveillance camera in the car. The controller is Taxi Helsinki<br />
Ltd." <br />
In addition to the notices in taxi cars, the controller’s website provides<br />
the general data protection statement of the controller and the data protection<br />
loste regarding recording camera surveillance. For recording camera surveillance<br />
in the privacy statement of the recording camera surveillance<br />
• The data transmission system of the controller for the processing of personal data<br />
camera surveillance system for recording the image and sound of cars<br />
through the system<br />
• Registered groups<br />
• Purposes of processing<br />
• Legal basis of the proceedings <br />
• The legitimate interests of the controller when the processing is based on a general<br />
Article 6 (1) (f) of the Regulation<br />
• Personal data to be processed<br />
• Information on safety camera surveillance notices placed in cars<br />
• Information on the operators employed by the controller who receive<br />
process such personal data<br />
• Information about the recipients of personal data.<br />
In other respects, the Security Camera Surveillance Privacy Statement refers to the controller<br />
general privacy statement. The general data protection statement shall inform the<br />
processing of data in so far as such data do not survive security camera surveillance<br />
detailed data protection statement. Such a general privacy regulation<br />
Required by Articles 12 and 13 and set out in the controller’s general data protection statement<br />
information is <br />
• the identity and contact details of the controller<br />
• Contact details of the Data Protection Officer<br />
• Criteria for determining the retention period of personal data<br />
• the right of the data subject to request from the controller access to data relating to him<br />
personal data and the right to request the rectification or erasure of such data.<br />
restricting or opposing the processing and the right to transfer<br />
information from one system to another<br />
In addition, the controller 's general privacy statement sets out the information on personal data<br />
extradition outside the European Economic Area and the right to withdraw consent<br />
when the processing of personal data is based on Article 6 (1) of the General Data Protection Regulation<br />
paragraph (a).<br />
In addition to safety camera notices and privacy statements, the controller has provided information<br />
on the processing of personal data in the framework of camera surveillance on<br />
in two bulletins: Information on Taxi Helsinki Taxi Safety Cameras<br />
published on 13 November 2019 and the Voice Recording will be deleted from all Taxi Hel-<br />
in the bulletin on security cameras for taxis brokered by sinki Oy, which has been published<br />
15.11.2019.<br />
In a press release published on 13 November 2019, the registrar has described security cameras<br />
the processing of personal data as follows:<br />
1. Taxis Helsinki cars have a recording security camera. Some cameras record<br />
sound and image, part of a mere image.<br />
2. Security cameras shall be automatic and continuous recording with a new file<br />
flies over the old. The recordings remain for a few days, depending on the camera<br />
I drive.<br />
3. The security camera is in the car for safety and no recordings are made<br />
or go through non-special situations such as criminal suspicions.<br />
4. Security camera data shall only be released at the request of the authorities.<br />
5. Taxi In accordance with the GDPR, Helsinki has taken care that the customer's information is<br />
sheltered.<br />
6. The privacy statements can be found on our website at www.taksihel-<br />
sinki.fi/taksi-helsinki-oy/tietosuojaselosteet/<br />
In addition, the controller regrets that it has not indicated clearly enough<br />
in addition to the image in the security cameras, they record sound and tell you that the security camera is <br />
in the car only to ensure the safety of customers and drivers. In addition,<br />
the holder states in his bulletin that the installation of the cameras has taken into account<br />
the Protection Regulation and the 2001 decision of the Data Protection Board.<br />
In relation to the data protection statements maintained by the controller, the controller 13.11. published<br />
the bulletin specifies that security cameras are automatic and continuous,<br />
where the new file is saved on top of the old one and that the recordings remain<br />
I'll talk for a few days. The bulletin also adds to the privacy statement that<br />
security camera data shall only be released at the request of the authority and that the<br />
in accordance with the GDPR, the customer has ensured that the customer's data is protected.<br />
In a press release published on 15 November 2019, the registrar announces that the audio recording<br />
removed from taxis brokered by the controller.<br />
The bottom bar of the websites of the bulletins published by the controller contains a link to<br />
and further details of the controller’s general privacy policy.<br />
and the security camera surveillance privacy statement<br />
3.2. Transparency of processing in the context of the loyalty program<br />
tomato decision-making<br />
In connection with its loyalty program, the controller shall carry out an automatic<br />
including profiling.<br />
According to the registrar's report, it informs in connection with the loyalty program<br />
automatic decision-making in its data protection statements and separate publications.<br />
by means of notifications. In separate notifications, the controller refers to the notification<br />
in the registrar's mobile application, as well as in the notices published on the website 6<br />
regarding the launch of the loyalty program and its own loyalty program itself.<br />
The registrar has submitted his report as an appendix on 12 December 2019 on his website<br />
the general data protection statement described above and the marketing authorization<br />
and the customer register’s privacy statement, both of which apply to customer and<br />
processing of personal data of potential customers.<br />
The Privacy Statement, which clarifies the General Privacy Statement, concerns the processing of personal data.<br />
in particular the controller’s website, the controller’s application and the direct<br />
in the context of marketing. It does not specify in the context of the loyalty program<br />
personal data to be processed or its associated automatic decision-making. <br />
In the controller’s general data protection statement, the automatic decision-making<br />
marketing, product and customer analysis may involve profiling.<br />
and that the controller has a legitimate interest in using profiling, for example for marketing<br />
customer analyzes. This right is mentioned in the privacy statement<br />
opposes processing on the basis of a legitimate interest of the controller. The registrar is<br />
In its reply of 6 March 202020, it stated that it had not taken any steps to<br />
and the processing of personal data in connection with the customer analyzes mentioned in the description. In general<br />
on the other hand, this privacy statement does not specify the loyalty program<br />
legal basis and no information on the car to be carried out under the loyalty program.<br />
decision-making, including profiling. <br />
In a press release issued on 6 September 2018, the registrar states that it will publish<br />
a new loyalty program that allows taxi ride subscribers to have a loyalty program<br />
as a so-called VIP customer, the opportunity to get past the queue to order a car<br />
during urination. The registrar states in the press release that the loyalty program will be opened at the beginning<br />
only for users of the registrar's mobile application. About the content of the loyalty program<br />
it is said that that VIP clientele is achieved by running 10 mobile apps<br />
taxi journey booked within 60 days and that the benefits of VIP membership are valid only<br />
price per month. In addition, the loyalty program is announced to be launched on 10.9.<br />
with the application update.<br />
The registrar’s loyalty program website states that the loyalty program<br />
The program can be accessed using the registrar's mobile application or account on a regular basis.<br />
by downloading a taxi in the Helsinki metropolitan area from the registrar's taxi order number. So<br />
age registrar says there are two loyalty levels: VIP and SuperVIP. <br />
You can become a VIP customer by placing at least 10 phone orders in 60 days. VIP-<br />
Customer Phone Orders progress as the VIP customer calls the registrar<br />
order number, the system identifies the VIP customer, after which the customer<br />
the call is prioritized to the top of the queue. SuperVIP customership is achieved by making at least<br />
10 application or phone subscriptions within 60 days. SuperVIP customer required<br />
registration in the registrar's mobile application. In order to accumulate SuperVIP<br />
loyalty points Phone orders must be placed under the same number.<br />
from the mero registered in the application. The description also states that<br />
In connection with a perVip customer relationship, you can check your own loyalty program<br />
from the “My personal information” section of the mobile application and that information about the SuperVIP client subscription<br />
appears in the car when you order from both app and phone orders. Mo-<br />
the description of the more frequent loyalty levels states that with loyalty<br />
calls or calls and taxi orders always go past the queue even during peak hours. <br />
In addition, the Loyalty Program website states that “Each taxi ride is 10 points<br />
and 100 points, you become a VIP or SuperVIP customer. That is, everyone<br />
the ride will take you not only to your destination, but also closer to VIP membership! Loyalty level<br />
the benefits are always available to you one month at a time. The system always checks the order<br />
what your level is and thus know how to configure your call or subscription correctly.<br />
Loyalty does not require anything from you and does not oblige you to do anything. You can only<br />
enjoy the priority it brings. ” Likewise, the loyalty program shows where<br />
its mobile app can be downloaded.<br />
The websites of the notices published on the controller’s website as described above<br />
There is a link in the bottom bar of the page to the Privacy Statement page, where you can still find<br />
the controller’s general privacy statement and the marketing and customer registration<br />
the privacy statement. <br />
The menu of the registrar's mobile application shows how many points are<br />
the user of the application needs to reach the VIP level. When navigating from the application menu<br />
from ‘Settings’ to ‘Terms of Use’, you can access the controller application.<br />
options. The Terms of Use contain some information related to the processing of personal data,<br />
but no information about the loyalty program or related processing of personal data.<br />
At the bottom of the Terms of Use page is a link to what is on the registrar's website <br />
general data protection statement. 7 Loyalty program or related personnel<br />
no information on data processing can be found in the menu of the mobile application<br />
'Contacts and questions' or elsewhere in the application.<br />
4. Actors involved in the processing of personal data and their roles<br />
The controller considers himself to be the controller with regard to the personal data he processes.<br />
The controller has defined the following actors as its processors of personal data<br />
In connection with the reply submitted on 12 December 2019:<br />
• Telia / Inmics<br />
• MTI<br />
• Zendesk<br />
• Nets<br />
• Benemen<br />
• Motorists <br />
• Drivers<br />
In its reply of 6.3.2020, the controller has defined the following:<br />
operators as processors of personal data:<br />
• Avenla Oy<br />
• Zendesk Inc.<br />
• Arena Interactive Oy<br />
• LINK Mobility Oy<br />
• Telia Inmics-Nebula Oy<br />
• MTI Ltd, Data processing agreement<br />
• Atea Finland Oy<br />
• Mediatoimisto Voitto Oy<br />
• Nets Finland Oy<br />
• Benemen Finland Oy<br />
• Koodiviidakko Oy<br />
• Mediamaisteri Oy<br />
The registrar has provided the information specified in his reply of 6.3.2020<br />
agreements on the processing of personal data with processors of personal data.<br />
The registrar has stated in his report of 6.3.2020 that it works at least for orders<br />
with taxi drivers in connection with the receipt and execution of orders<br />
yhteisrekisterinpitäjänä. For this reason, the registrar has not provided taxi drivers<br />
agreements on the processing of personal data with The registrar submits that it<br />
will further clarify the arrangement between it and motorists, in particular their<br />
treatment operations where it and the motoring companies jointly determine<br />
the purposes and means of the processing of personal data. <br />
According to the data controller's report, order brokerage software must be placed in taxi cars<br />
The terminal is Android-based. In addition, the controller shall notify in the 'Contacts and Questions' section of its mobile application that its mobile application<br />
use the various software licenses that are<br />
• MIT licensed components: Adform tracking, SAMKeychain (iOS only)<br />
• Apache License 2.0 licensed components: KeyBoardVisibilityEvent<br />
(Android Only), Snackbar (Android only), Volley (Android only), Scytale<br />
(Android Only)<br />
• Facebook Licensed Components: Facebook SDK<br />
• Google Licensed or Google Premium Plan Components:<br />
Protobuf, Google Maps, Google Place.<br />
5. Description of processing operations<br />
As an annex to the report submitted on 12 December 2019, the data controller has submitted<br />
in accordance with Article 30 of the General Data Protection Regulation.<br />
its obligation to draw up a report on the processing operations.<br />
In addition, in his reply of 6 March 2019, the controller stated that the data<br />
In accordance with Article 30 of the General Data Protection Regulation, the following<br />
information:<br />
• The purposes of the processing of personal data; <br />
• The categories of personal data to be processed and the groups of data subjects; <br />
• Groups of recipients of personal data; <br />
• Transfer of personal data to a third country and criteria for data transfer; <br />
• Where possible, those designed to delete personal information<br />
deadlines; and<br />
• Where possible, a general description of the technical and organizational aspects<br />
security measures. <br />
6. Data protection impact assessment<br />
6.1. Impact assessment on the processing of location data<br />
On 6 February 2020, the controller submitted a data protection impact assessment,<br />
concerning the processing of location data and drawn up in accordance with the<br />
according to the date appearing in the document, 4 December 2019.<br />
The impact assessment on the processing of location data includes the following main<br />
sections: description of personal data, contributing to the proportionality and necessity of the processing<br />
measures to promote the rights of the taxi customer and the motorist / driver (hereinafter<br />
measures to manage risks to the client’s rights and freedoms.<br />
describes the involvement of stakeholders, the measures planned to address the risks<br />
protection and security measures and mechanisms to ensure the protection of personal<br />
data protection.<br />
According to the response provided by the registrar on 6 March 2019, it has taken the MTI<br />
to use the brokerage software in June 2017. Previously delivered on 12.12.2019<br />
according to the study, all taxi orders are logged in the MTI brokerage system. The system<br />
the order number of the order, the number of the car making the order, the driver<br />
id, the customer’s pick-up address, any destination address, and the departure and arrival<br />
moment to destination. The ride route is stored in the system as well as in the car<br />
speeds. In most cases, the customer's telephone number is also linked to the order. customers<br />
the name and e-mail address may also be stored (depending on the subscription channel).<br />
6.2. Data protection impact assessment on security camera surveillance<br />
In its reply of 6 March 2020, the controller considered that it should not have drawn up a<br />
data protection impact assessment pursuant to Article 35 of the Data Protection Regulation<br />
the use of personal data in the context of security camera surveillance of taxi cars<br />
the General Data Protection Regulation, the Data Protection Act or the decision of the<br />
on the basis of that list.<br />
According to the report provided by the controller, it collects security camera surveillance<br />
video and audio recordings that are time- and location-specific.<br />
The security cameras in the registrar's report describe not only the interior of the taxi car but also<br />
taxi car environment. Iltasanomat, the registrar’s service manager, was given 13 November 2019<br />
According to this video interview, newer security cameras record in addition to the image<br />
sound and describe the interior of the car in addition to the front of the car. 8<br />
The controller has clarified that the number of its registrants is calculated in hundreds of<br />
that it handles around four million taxis a year and that its<br />
it covers a total of more than 2,000 cars with recordable security camera surveillance. Val-<br />
most of the taxis brokered by the controller operate mainly in the main<br />
tick in the area.<br />
According to the information on the controller’s website, the controller provides information<br />
taxi services for specific customer groups, such as seniors<br />
disabled taxi services.<br />
6.3. Data protection impact assessment for automatic decision - making<br />
In its reply of 6 March 2020, the controller considered that it should not have drawn up a<br />
data protection impact assessment pursuant to Article 35 of the Data Protection Regulation<br />
automatic decision-making in the context of its loyalty program,<br />
including profiling, the processing of personal data<br />
a list decided by its Data Protection Regulation, the Data Protection Act or the Data Protection Officer<br />
by.<br />
According to the registrar’s report, the car operated by its loyalty program<br />
decision-making is limited to identifying phone or application subscriptions. Provided<br />
the registrant has ordered a taxi ride by phone or using the ordering application 10 times<br />
Within 60 days, the customer will be automatically classified as a VIP customer,<br />
when placing a new order, passes a possible queue. The controller considers that<br />
its automatic decision-making in the context of the loyalty program<br />
purchase, including profiling, has no legal effect or other significant effect.<br />
to the data subject. <br />
Based on the data controller's report, the personal data it processes are automatic<br />
decision-making, including profiling, is based on telephone numbers,<br />
information on orders placed with the taxi application and whether the registered<br />
VIP level.<br />
Legal issues<br />
1. Does the controller process personal data collected in connection with security camera surveillance with the general public?<br />
in accordance with Article 6 (1) (f) of the Data Protection Regulation<br />
2. Is the processing of both audio and video data in the context of security camera surveillance by the controller<br />
the principle of minimization in accordance with Article 5 (1) (c) of the General Data Protection Regulation<br />
according to the<br />
3. Does the information provided by the controller to data subjects reflect the general data protection Regulation 12?<br />
the information required by Article 1 (1) in such a way that such information can be easily understood; and<br />
at hand<br />
3.1. Regarding security camera surveillance by the controller in taxi cars<br />
3.2. Regarding the automation of the controller in the context of the loyalty program<br />
decision-making, including profiling<br />
4. Has the controller identified the actors involved in the processing of its personal data in the<br />
in accordance with Article 4 (7) to (8), Article 26 and Article 28 of the <br />
5. Does the description of the processing operations provided by the controller comply with Article 30 of the General Data Protection Regulation?<br />
requirements of this Article<br />
6. Data protection impact assessment<br />
6.1. Does the location data processing data provided by the controller correspond to<br />
requirements of Article 35 of the General Data Protection Regulation<br />
6.2. Is the controller obliged to draw up a security camera surveillance of taxi cars?<br />
Article 35 of the General Data Protection Regulation on the processing of personal data<br />
data protection impact assessment in accordance with<br />
6.3. Is the controller obliged to draw up a program in connection with the loyalty program?<br />
automatic decision-making, including profiling, public information<br />
data protection impact assessment under Article 35 of the Data Protection Regulation<br />
The matter is pending before the Sanctions Chamber of the EDPS <br />
7. If the activities of the controller are considered to be as described in the above paragraphs<br />
the matter is contrary to or incomplete in the General Data Protection Regulation<br />
whether the General Data Protection Regulation should be laid down in Article 58 of the General Data Protection Regulation<br />
administrative penalty fee in accordance with Article 2 (2) (i) and Article 83 and its<br />
amount.<br />
Decision of the Assistant Supervisor<br />
1. The Assistant EDPS shall, in accordance with Article 58 (2) (d) of the General Data Protection Regulation,<br />
Article 6 (1) (f) of the General Data Protection Regulation.<br />
the balancing test required by the first subparagraph and provide a report on the measures taken<br />
to the Office of the Data Protection Officer within one month of the adoption of this Decision.<br />
2. The Assistant EDPS shall, in accordance with Article 58 (2) (d) of the General Data Protection Regulation,<br />
the controller to ensure that the processing of audio data in taxi security cameras<br />
in the event of supervision without objective justification shall be terminated immediately. The controller shall<br />
report on the measures taken to the Office of the Data Protection Officer within one month<br />
within one month of the adoption of this Decision.<br />
3. The Assistant EDPS shall, in accordance with Article 58 (2) (d) of the General Data Protection Regulation,<br />
the controller to change the security camera surveillance and the loyalty program<br />
automatic decision-making, including profiling,<br />
information processing practices in such a way that the information it provides to data subjects<br />
all the information required by Article 12 (1) of the General Data Protection Regulation<br />
in an easily accessible and comprehensible form, and to provide a report on the action taken.<br />
the Office of the Data Protection Officer within one month of the adoption of this Decision.<br />
the two.<br />
4. The Assistant EDPS shall, in accordance with Article 58 (2) (d) of the General Data Protection Regulation,<br />
the controller to comprehensively define the operators<br />
to the controller as a processor of personal data. In addition, the controller must determine to what extent it<br />
acts as joint registrar in accordance with Article 26 of the General Data Protection Regulation for taxi<br />
and entrepreneurs. The controller shall submit to the Office of the Data Protection Officer for information<br />
within one month of the adoption of this Decision<br />
4.1. An explanation of how the controller has defined the software of the Taxi Helsinki mobile application<br />
the role of licensing providers vis-à-vis the controller in relation to the processing of personal data<br />
and on what basis.<br />
4.2. Arrangements for joint registration with taxi drivers, and<br />
4.3. An explanation of any other measures taken in relation to the processing of personal data<br />
actors and their roles from the point of view of the processing of personal data.<br />
5. The Assistant Data Protection Supervisor shall, in accordance with Article 58 (2) (d) of the General Data Protection Regulation,<br />
the controller to bring the processing of personal data into line with the general<br />
requirements of Article 30 of the Protection Regulation and to provide a report on the measures taken<br />
to the Office of the Data Protection Officer within one month of the adoption of this Decision.<br />
6. Data protection impact assessments<br />
6.1. In accordance with Article 58 (2) (d) of the General Data Protection Regulation, the Assistant<br />
that the controller must draw up a personal data processing plan.<br />
processing of personal data pursuant to Article 35 of the General Data Protection Regulation<br />
spring impact assessment.<br />
6.2. In accordance with Article 58 (2) (d) of the General Data Protection Regulation, the Assistant<br />
that the controller must draw up a security camera<br />
general data protection regulation on the processing of personal data in connection with<br />
Data protection impact assessment under Article 35. <br />
6.3. In accordance with Article 58 (2) (d) of the General Data Protection Regulation, the Assistant<br />
that the controller must prepare the content of its loyalty program<br />
automatic decision-making, including profiling.<br />
processing of personal data pursuant to Article 35 of the General Data Protection Regulation<br />
the impact assessment.<br />
In this context, the Assistant EDPS draws attention to the general provisions of the<br />
the obligation to consult the supervisory authority in accordance with Article 36 thereof, if<br />
based on the impact assessment, there is a need for this.<br />
Grounds for the decision of the Assistant Data Protection Supervisor<br />
1. Legitimate under Article 6 (1) (f) of the General Data Protection Regulation<br />
advantage as a basis for addressing security camera surveillance and the lack of<br />
test<br />
Article 6 of the General Data Protection Regulation lists the situations in which the processing of personal data may take place<br />
can be considered legal. According to paragraph 1 (f) of that Article, one of these situations<br />
responses have it, when the treatment is necessary for the operator or a third party authorized to<br />
interests, except where the interests of the data subject or<br />
rights and freedoms override such benefits, especially if the data subject is a child (later<br />
legitimate interest).<br />
According to recital 47 of the General Data Protection Regulation, such a legitimate interest may exist<br />
exist, for example, where there is a relevant and relevant relationship between the data subject and the controller.<br />
such that the data subject is a customer of or employed by the controller.<br />
According to the same paragraph, the existence of a legitimate interest must in any event be<br />
basis; must assess, inter alia, whether the data subject can reasonably expect the collection of personal data<br />
at the time and in the context that personal data may be processed for that purpose. eTEN<br />
the interests and fundamental rights of the data subject could override the interests of the controller if the<br />
processed in circumstances where the data subject cannot reasonably expect further processing.<br />
According to Article 5 (1) (a) of the General Data Protection Regulation, personal data must be<br />
lawfully, properly and transparently for the data subject. Article 2 of the same article<br />
paragraph 1, the controller shall be responsible for it and shall be able to demonstrate that paragraph 1<br />
has been complied with (the so-called obligation to demonstrate).<br />
The application of a legitimate ground of priority under the General Data Protection Regulation requires<br />
on the one hand the legitimate interests of the data controller or third-party evaluation of the existence and<br />
on the other hand, an assessment of whether the legitimate interest of the controller overrides the interests of the data subject or<br />
rights or freedoms. The existence of a legitimate interest of the controller may be demonstrated by this<br />
with the so-called balance test. <br />
The Office of the Data Protection Supervisor has included in its guidelines published on 24 May 2018<br />
the use of its legitimate interest as a legal basis. In particular, the performance of the balancing test<br />
the Office of the Security Officer instructs that the test must be prepared in accordance with the obligation to demonstrate<br />
a written description enabling the controller to demonstrate, where appropriate, that the activity is of a general nature<br />
in accordance with the Data Protection Regulation. In its instructions, the EDPS shall specify the balance<br />
six steps for performing the test with explanations. The guidelines call for the test to be repeated.<br />
and update the description if the purpose, nature or purpose of the processing of personal data<br />
the context changes. <br />
The statement received from the controller indicates that it has not prepared or documented a<br />
legitimate interest in accordance with Article 6 (1) (f) of the Data Protection Regulation.<br />
the balancing test required for the application of the<br />
Therefore, the EDPS considers that the controller has not been able to demonstrate<br />
in accordance with Article 5 (2) of the General Data Protection Regulation, that the processing of<br />
in the context of camera surveillance complies with Article 5 (1) (a) of the General Data Protection Regulation.<br />
and Article 6 (1) (f).<br />
The EDPS draws attention to the fact that the opinion of the Data Protection Board of 25 February 2002<br />
This Decision concerns the processing of audio data in the context of security camera surveillance. Now under evaluation<br />
the processing of personal data and the technology used in connection therewith have changed<br />
significantly, so that the controller cannot rely on<br />
the decision of the panel and the assessments made in the context of the impact of the<br />
the interests, rights or freedoms of data subjects, as such. <br />
Nor can the data controller’s claim that the general data protection regulation<br />
application of Article 6 (1) (f) of this Regulation, including those relating to the balancing test<br />
requirements, the legal situation would be so unclear that compliance could not be required by the<br />
from suppliers. The EDPS draws attention to the fact that the information contained in the balancing test<br />
and the obligation to document in accordance with the obligation to demonstrate is defined in the<br />
protection regulation and that the general data protection regulation does not require a balancing test in a particular<br />
in terms of. The EDPS also draws attention to the controller's argument<br />
that the website of the Office of the Data Protection Officer contains a comprehensive and practical<br />
how the balance test can be performed.<br />
2. The processing of audio and video data in the context of security camera surveillance<br />
in the light of the principle of minimization set out in Article 5 (1) (c) of the Regulation<br />
According to Article 5 (1) (c) of the General Data Protection Regulation, personal data must be:<br />
appropriate and relevant and limited to what is necessary in<br />
for which they are processed (the so-called data minimization principle).<br />
According to recital 39 of the General Data Protection Regulation, ‘… personal data should be<br />
and relevant and limited to what is necessary for the purposes for which they are processed.<br />
of view. This requires, in particular, that the retention period for personal data be as short as possible.<br />
Personal data should only be processed if the purpose of the processing cannot reasonably be achieved<br />
by other means. "<br />
The report received from the controller and any other report obtained by the EDPS’s office is<br />
ests. The Office of the EDPS has not been provided with unambiguous information on whether the<br />
the controller intended to process both audio and video data in the context of security camera<br />
conjunction. <br />
On the basis of the report provided by the controller and the publicly available information, it is<br />
that the controller has been aware that the audio data will be processed in some of its transmission<br />
taxi vehicles covered by this Regulation and that it has considered such treatment to be appropriate<br />
at least until 15 November 2019, as soon as cameras with voice recording function are installed.<br />
said housing. The controller may be deemed to have taken steps to terminate the processing<br />
December 20, 2019, when it called the cars covered by its brokerage service for voice recording operations<br />
to deactivate. <br />
Although the controller has reformulated the purposes of the processing as the case progressed,<br />
safety and the investigation of criminal offenses and damage can be considered as the basis for the<br />
common elements for the purposes of security camera surveillance when such processing<br />
based on a legitimate interest. Until the controller has taken steps to<br />
to eliminate flight and when voice recording has still been used in some cars, processing<br />
purposes, the report provided by the controller and publicly available must be considered<br />
including monitoring of operational processes on the basis of privacy statements. <br />
In its report, the controller has not provided any justification as to why it has processed the<br />
in addition to the data, audio data in some of their cars. On the other hand, the controller has<br />
argued at a later stage that the processing of audio data was an error. As above<br />
it has emerged that this is inconsistent with other clarification received in the case.<br />
Since, on the basis of the controller’s report, it processes image data in all its cars,<br />
the processing of image data shall be deemed to be its normal processing and the processing of<br />
van beyond this.<br />
The security camera surveillance practice indicated by the controller, in which only part of its<br />
In addition to image data, voice data and data from the controller are also recorded.<br />
On the basis of this report, it can be concluded that the processing of audio data has not been necessary<br />
for the purposes defined by it and that it has been able to achieve the security camera<br />
the purposes of the processing of personal data which it has defined for the purposes of<br />
by.<br />
Accordingly, the EDPS considers that the processing of the controller's voice data is secure.<br />
In addition to image data in the context of camera surveillance, there has been no<br />
accordance with the principle of data minimization in paragraph 1 (c) and has not been able to<br />
demonstrate compliance with the same section of the General Data Protection Regulation<br />
in accordance with Article 5 (2) of that Regulation.<br />
3. Transparency of processing as required by Article 12 (1) of the General Data Protection Regulation<br />
in this way<br />
Article 12 of the General Data Protection Regulation requires the controller to take appropriate action<br />
measures to provide the data subject with the information in accordance with Articles 13 and 14 and Articles 15 to 22 and<br />
All processing information in accordance with Article 34 in a concise, transparent, easily accessible manner<br />
in a comprehensible and accessible form in clear and simple language, in particular<br />
where the information is intended specifically for a child. The information must be provided in writing or otherwise<br />
and, where appropriate, in electronic form.<br />
According to Article 13 of the General Data Protection Regulation, when collecting personal data<br />
personal data must be provided by the controller to the data subject when personal data are received<br />
all of the following information: <br />
(a) the identity and contact details of the controller and, where applicable, of any such representative;<br />
information; <br />
(b) where applicable, the contact details of the Data Protection Officer;<br />
(c) the purposes for which the personal data are processed and the legal basis for the processing;<br />
d) the legitimate interests of the data controller or a third party, if the processing is based on Article 6<br />
Paragraph 1 (f); <br />
(e) the recipients or categories of recipients of the personal data; <br />
(f) where applicable, the fact that the controller intends to transfer personal data to a third party<br />
country or international organization, and information on the adequacy of the data protection to the Commission<br />
the existence or absence of a decision, or in the case of Articles 46 or 47, or<br />
Referred to in the second subparagraph of Article 49 (1), information on appropriate or<br />
and how to obtain a copy of them or where they are placed.<br />
making available.<br />
In addition to the information referred to in paragraph 1, the controller shall, when personal data<br />
provide the data subject with the following additional information necessary for the proper and<br />
to ensure fast handling: <br />
(a) the period for which the personal data will be stored or, if that is not possible, the criteria for determining that period; <br />
(b) the right of the data subject to request from the controller access to personal data concerning him or her;<br />
the right to request the rectification or erasure or processing of such data<br />
restriction or opposition to processing and the right to transfer data from one system to another; <br />
(c) the right to withdraw consent at any time without prejudice to the grounds for<br />
the lawfulness of the processing carried out before its cancellation, if the processing<br />
based on Article 6 (1) (a) or Article 9 (2) (a); <br />
(d) the right to lodge a complaint with the supervisory authority; <br />
(e) whether the provision of personal data is a legal or contractual requirement or<br />
the requirement for the conclusion of the contract and whether the data subject is obliged to supply<br />
personal data and the possible consequences of not providing such data; <br />
(f) automatic decision-making, including the procedure referred to in Article 22 (1) and (4);<br />
the existence of filing, as well as, at least in these cases, the relevant data for processing<br />
as well as the significance and possible consequences of that processing.<br />
to the data subject.<br />
3.1. Registrar 's information policy regarding security camera surveillance<br />
The information required by Article 13 (2) (de) of the General Data Protection Regulation is missing<br />
from the controller’s privacy statements in its entirety, and the controller has not demonstrated that<br />
dot would be available to registrants elsewhere.<br />
When informing the controller of the processing of voice data, the security camera surveillance<br />
there is a mismatch between the various channels of communication. First, in taxis<br />
the security camera surveillance notification does not specifically describe or mention the<br />
flying.<br />
The notices on the taxis also do not refer to the security camera of the controller.<br />
privacy statement or elsewhere from which passengers would have been informed<br />
processing of audio data. Information on the processing of audio data has been found only for security camera surveillance<br />
on 13 November 2019 and 15 November 2019 on the website of the controller.<br />
following the publication of these bulletins. <br />
The controller has been deemed to have processed or processed audio data as described above.<br />
Consequently, the controller has not informed the data subjects of its processing of personal data.<br />
Article 12 (1) of the General Data Protection Regulation<br />
and has not informed the data subjects about the processing of audio data<br />
security camera surveillance in such a way that this would have been the case under Article 5 of the General Data Protection Regulation<br />
as required by Article 12 (1) (a) and Article 12 (1) <br />
understandable and accessible and has not been able to demonstrate compliance with the<br />
accordance with Article 5 (2) of the General Data Protection Regulation.<br />
3.2. The controller’s information policy regarding transactions made in connection with the loyalty program<br />
automatic decision-making, including profiling<br />
Contrary to Article 12 (1) of the General Data Protection Regulation, the controller's privacy statements are missing<br />
information pursuant to Article 22 of the General Data Protection Regulation.<br />
the right not to be subject to automatic individual decisions, including profiling,<br />
in. The controller has not shown that this information can be found elsewhere.<br />
The controller 's privacy statement shall not contain information in accordance with Article 13 (1) (c)<br />
the legal basis on which its automatic loyalty program<br />
decision-making, including profiling. The loyalty program cannot be<br />
the marketing, product and product information referred to in the data protection statement of the<br />
analyzes which it claims to carry out on the basis of a legitimate interest, even if that<br />
processing may involve automatic decision making, including profiling, as it does not<br />
has not yet undertaken that treatment. The controller has not demonstrated<br />
that information on the grounds for processing could be found elsewhere.<br />
The legal basis for automatic decision-making in the context of the loyalty program<br />
when it is unclear, the data subjects' rights are also not communicated in a transparent manner. In particular,<br />
Article 21 (1) of the General Data Protection Regulation<br />
the meaning of the processing in the legitimate interest of the controller remains unclear. <br />
The registrar’s automatic decision-making process in the context of the loyalty program<br />
including profiling, the data protection statements lack the general data protection regulations<br />
information pursuant to Article 13 (2) (f) thereof,<br />
the existence of the profiling referred to in Article 22 (1) and (4)<br />
relevant information on the processing logic as well as<br />
significance and possible consequences for the data subject. <br />
The registrar’s loyalty program website describes how to determine VIP membership.<br />
its grounds. The Loyalty Program website lacks unambiguous information about the autoresponder<br />
the existence of a decision and the processing of personal data concerning it. This information is<br />
in particular to enable data subjects to exercise their data protection rights<br />
during processing. <br />
The privacy statements on the registrar's website are not linked to the loyalty program<br />
website or vice versa in such a way that the data subject receives it in an easy and comprehensible form<br />
an overview of the processing of personal data by the controller in the framework of loyalty<br />
in the context of its program.<br />
The EDPS considers that the information policy of the controller does not<br />
automatic decision-making under the program is the responsibility of the General Data Protection<br />
conditions laid down in Article 12 (1) of the Regulation. The controller has not demonstrated<br />
information elsewhere. Consequently, it has also not been able to demonstrate<br />
compliance with Article 12 of the Data Protection Regulation and Article 5 (2) of the General Data Protection Regulation<br />
in accordance with.<br />
4. Actors involved in the processing of personal data <br />
According to Article 4 (7) of the General Data Protection Regulation, “controller” means the<br />
a list of any person or entity, authority, agency or other body, alone or jointly<br />
defines with others the purposes and means of the processing of personal data; if such processing<br />
purposes and means are defined in Union or Member State law, the controller<br />
or specific criteria for his appointment may be laid down in Union law or in the Member States.<br />
in accordance with national law. For the purposes of paragraph 8 of the same Article,<br />
natural or legal person, authority, agency or any other body which<br />
processes personal data on behalf of the controller.<br />
According to Article 26 of the General Data Protection Regulation <br />
1. If at least two controllers jointly determine the purposes and means of processing, they shall:<br />
are joint registrars. They define each other in a transparent manner<br />
each area of responsibility in order to comply with the obligations laid down in this Regulation,<br />
the exercise of registered rights and the provision of information in accordance with Articles 13 and 14<br />
unless and to the extent applicable to data controllers<br />
Union law or the law of a Member State defines the responsibilities of controllers<br />
areas. In connection with the arrangement, a contact point may be designated for data subjects.<br />
2. The arrangement referred to in paragraph 1 shall duly reflect the common registers<br />
the real roles and relationships of keepers vis-à-vis data subjects. Key elements of the arrangement<br />
must be available to the data subject.<br />
3. Notwithstanding the terms of the arrangement referred to in paragraph 1, the data subject may<br />
their rights under this Regulation in relation to each controller and each controller.<br />
will be opposed.<br />
Pursuant to Article 28 (3) of the General Data Protection Regulation, the processing of personal data<br />
processing shall be determined by agreement or other provision of Union law or of the law of a Member State.<br />
a legal instrument in accordance with national law which binds the controller in relation to the<br />
the subject and duration of the processing, the nature and purpose of the processing,<br />
the type of personal data and the categories of data subjects, the obligations and rights of the controller. Here<br />
agreement or other legal instrument shall provide in particular that the personal data<br />
processor <br />
(g) process personal data only in accordance with the documented instructions issued by the controller<br />
transfer of personal data to a third country or<br />
unless the law of the Union applicable to the controller<br />
or the law of a Member State requires otherwise, in which case the personal data<br />
The controller shall inform the controller of this legal requirement before<br />
unless such information is prohibited by that law in the public interest.<br />
for important reasons; <br />
(h) ensure that persons entitled to process personal data have undertaken to comply with<br />
to be bound by an obligation of professional secrecy or are subject to appropriate legal<br />
the maintenance obligation; <br />
(i) take all measures required by Article 32; <br />
(j) comply with the conditions for the use of another processor referred to in paragraphs 2 and 4;<br />
tyksiä; <br />
(k) taking into account the nature of the processing operation, assist the controller in<br />
and organizational measures, as far as possible, to<br />
obligation on the operator to respond to requests for registration as provided for in Chapter III.<br />
exercise of the rights of the data subject;<br />
(l) assist the controller in ensuring that the obligations laid down in Articles 32 to 36 are complied with<br />
shall be complied with, taking into account the nature of the processing and the availability of personal data to the controller<br />
available information; <br />
(m) remove or restore processing services at the discretion of the controller<br />
upon completion of the provision, all personal data shall be transferred to the controller and deleted<br />
copies, unless required by Union law or the law of a Member State<br />
retain personal information; <br />
(n) make available to the controller all information necessary for the purposes of this Article.<br />
to demonstrate compliance with those obligations, and shall allow the controller or<br />
audits carried out by another auditor authorized by the controller, such as inspections,<br />
as well as participating in them.<br />
The EDPS considers that the controller has defined his role in the general<br />
in accordance with Article 4 (7) of the Data Protection Regulation. In addition, processors of personal data<br />
at least those operators with whom the controller has drawn up a personal data<br />
sittelysopimuksen.<br />
For software license providers of the registrar's mobile application, the registrar does not<br />
has not identified any operator as a processor of personal data and has not provided a clear<br />
the role of these actors in the processing of the controller’s personal data; or<br />
measures taken with them with regard to the processing of personal data. From public sources<br />
at least AdIT tracking and Facebook licensed by MIT<br />
SDK services basically include the processing of personal data. According to public sources,<br />
whereas the inclusion of these services in the application also requires some form of relationship;<br />
such as the conclusion of a contract or the acceptance of terms of use, the subscriber and its<br />
between. <br />
In its reply of 6 March 2020, the registrar has submitted the report submitted on 12 December 2019.<br />
by way of derogation, that the taxi driver undertakings covered by the controller do not<br />
would be processors of personal data but that they would act as independent controllers on the one hand and<br />
on the other hand, as joint controllers with the controller referred to in this case. registration<br />
According to the controller, the joint registrar would be concerned, for example, with taxi bookings.<br />
upon receipt and execution of orders. The controller has not<br />
the Office of the European Data Protection Supervisor in accordance with Article 26 of the General Data Protection Regulation.<br />
of these, an arrangement between it and the motorist companies or other clarification of the joint registrar<br />
to demonstrate. According to the registrar's reply of 6.3.2020, it will come in the future<br />
to clarify the arrangements between it and motorists, in particular as regards their handling operations,<br />
where it and the motorists jointly determine the purposes for which the personal data will be processed; and<br />
means. <br />
In his report, the controller has stated that the personal data processed by him are not<br />
outside the European Economic Area without an appropriate transfer basis. Help-<br />
In this context, the EDPS has not<br />
questions are limited to the field covered by this Decision.<br />
else- where.<br />
For the reasons described above, the EDPS considers that the controller is not in a position to<br />
have shown that it has defined the personal data which it processes as controller<br />
comprehensive processing of personal data involved in the processing.<br />
Similarly, the Deputy Data Protection Officer considers that the controller has not been able to demonstrate that:<br />
it would have defined the common register as required by Article 26 of the General Data Protection Regulation.<br />
the purposes and means of processing with the motorists they consider to be<br />
when they act as the joint registrar, as indicated by the controller. Registrar<br />
nor has it shown that it drafted the same article <br />
mutual agreement on the joint registrar with the joint registrar.<br />
Consequently, the controller has not been able to demonstrate the points of the Regulation described above<br />
in accordance with Article 5 (2) of the General Data Protection Regulation.<br />
5. Description of processing operations<br />
According to Article 30 of the General Data Protection Regulation, each controller and, where<br />
the registrar's representative shall keep a record of the processing operations for which he is responsible. It-<br />
the statement must include all of the following information:<br />
(a) the identity of the controller and any joint controller, the representative of the controller and the<br />
the name and contact details of the security officer; <br />
(b) the purposes of the processing; <br />
(c) a description of the categories of data subjects and the categories of personal data; <br />
(d) the categories of recipients to whom the personal data have been or will be disclosed;<br />
including recipients in third countries or international organizations.<br />
JAT; <br />
(e) where applicable, information on the transfer of personal data to a third country or internationally<br />
organization, including information on which third country or international organization is<br />
appropriate safeguards in the case of Article 49<br />
The transfer referred to in the second subparagraph of paragraph 1; <br />
(f) as far as possible, the planned deadlines for deleting the different categories of data; <br />
(g) as far as possible, a general description of the technical specifications referred to in Article 32 (1)<br />
and organizational security measures. <br />
That statement shall be in writing, including in electronic form. The register<br />
the keeper shall make the report available to the supervisory authority upon request. The obligation to maintain<br />
this description of processing operations does not apply to a company or organization with less than 250 employees,<br />
unless its processing is likely to jeopardize the data subject 's rights; and<br />
freedoms, the processing is not incidental or subject to the conditions referred to in Article 9 (1).<br />
specific categories of data or the convictions or infringements referred to in Article 10.<br />
personal data.<br />
According to recital 82 of the General Data Protection Regulation, the controller or the<br />
The controller should keep a register of the processing operations for which he is responsible.<br />
demonstrate that they comply with this Regulation. Registrars and personal information<br />
processors should be required to cooperate with the<br />
processing records on request in order to allow processing operations<br />
monitor on their basis.<br />
As described above, the controller has provided a general privacy statement, recordable<br />
a detailed privacy statement on security camera surveillance as well as a marketing<br />
detailed privacy statement. <br />
The data protection statements of the controller may be considered to cover the following<br />
information in accordance with Article 30 (1) (bd), (f) and (g) of the Safeguard Regulation. The same<br />
The information in points (a) and (e) of this Regulation is only partially clear. <br />
Information pursuant to Article 30 (1) (a) of the General Data Protection Regulation shall be<br />
the name and contact details of the controller and the contact details of the data protection officer. Representative of the controller<br />
the name of the controller and the data protection officer are missing. Also, no information can be found in the privacy statements<br />
in the reply provided by the controller on 6 March 2019.<br />
organ- isation.<br />
In accordance with Article 30 (1) (e) of the General Data Protection Regulation, the controller is<br />
included in the privacy statements information on transfers of personal data to third countries and<br />
applicable transfer criteria. The registrar's privacy statements, on the other hand, lack information<br />
the countries to which the personal data are transferred.<br />
The Assistant EDPS considers that the privacy statements provided by the controller are not<br />
meets the requirements of the General Data Protection Regulation as described above.<br />
the controller has thus not demonstrated that it has complied with Article 30 of the General Data Protection Regulation.<br />
obligations under this Article and has not been able to demonstrate compliance with<br />
in accordance with Article 5 (2) of the General Data Protection Regulation.<br />
The EDPS also considers, firstly, that the General Data Protection Regulation does not<br />
require that a report on the processing operations be drawn up in a specific form other than that<br />
in writing, including in electronic form. The report processing operations can therefore<br />
in any document format. The table published by the EDPS Office<br />
The advantages of this format can be seen in the clear structure and concise presentation, but it is<br />
however, only one example of report processing operations to prepare. Secondly, the general<br />
nor does the protection regulation require the document to be designated as a description of processing operations.<br />
Most importantly, however, the content of the document complies with Article 30 of the General Data Protection Regulation.<br />
conditions. However, it may be justified from the point of view of the registrar's document management<br />
designate documents according to which section of the General Data Protection Regulation<br />
the medication document is intended to show. Third, attention must be paid to the general<br />
The record of processing operations in accordance with Article 30 of the Data Protection Regulation is<br />
under Article 5 (2) of the General Data Protection Regulation.<br />
to the Authority on the one hand and the Authority on the other<br />
the primary evaluation document and the tool for obtaining an overall picture of the controller’s<br />
processing of personal data. <br />
6. Data protection impact assessment<br />
According to Article 35 (1) of the General Data Protection Regulation, if a certain type of processing<br />
new technology is likely to cause - the nature, extent,<br />
the rights and freedoms of the natural person.<br />
high risk, the controller shall carry out an assessment of the planned<br />
the effects of processing operations on the protection of personal data. One estimate can be used in a similar<br />
similar high-risk treatment operations.<br />
A data protection impact assessment is required by Article 35 (3) of the General Data Protection Regulation<br />
in particular, inter alia, where the processing involves the death of natural persons<br />
systematic and comprehensive assessment of individual characteristics based on automatic<br />
processing, such as profiling, and leads to decisions<br />
legal effects or which have a similarly significant effect on a natural person.<br />
manner; and when the processing of personal data is a systematic area open to the public<br />
control. The data protection impact assessment is covered by the General Data Protection Regulation 35<br />
accordance with Article 7 (7)<br />
(a) a systematic description of the treatment operations envisaged and the purposes of the treatment,<br />
including, where appropriate, the legitimate interests of the controller; <br />
(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; <br />
(c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1;<br />
and <br />
(d) the measures planned to address the risks, including protection and security measures;<br />
mechanisms and mechanisms to ensure the protection of personal data and to demonstrate that<br />
taking into account the rights of data subjects and other interested parties, and<br />
legitimate interests.<br />
Pursuant to Article 99 (2) of the General Data Protection Regulation, the General Data Protection Regulation is to be initiated<br />
to apply on 25 May 2018.<br />
According to recital 84 of the General Data Protection Regulation, compliance with this Regulation<br />
in cases where processing operations are likely to involve natural persons.<br />
the high risk to the rights and freedoms of individuals, the controller should be responsible for<br />
impact assessment, in particular on the origin,<br />
to assess the specific nature and severity of the disease. The outcome of the evaluation should be taken into account<br />
determining the appropriate steps to be taken to demonstrate that the personal<br />
processing of personal data complies with the provisions of this Regulation. If the data protection<br />
assessment shows that there is a high risk of<br />
the operator cannot take appropriate measures to reduce the cost of available technology and<br />
the supervisory authority should be consulted prior to the processing.<br />
In its Guidance on Impact Assessments 9, the Data Protection Working Party has provided examples of<br />
where an impact assessment should be carried out. According to the guidelines, the data protection<br />
assessment must normally be carried out in accordance with Article 35 (3) of the General Data Protection Regulation<br />
in addition to processing operations, if the processing of personal data fulfills two of the following conditions<br />
criteria. The more of these criteria are met, the more likely it is that personal data will be<br />
high risk to the rights and freedoms of data subjects:<br />
• Evaluation and scoring of personal data (including profiling and forecasting)<br />
• Automatic decision-making with legal effects<br />
• Systematic monitoring of data subjects<br />
• Data belonging to specific categories of personal data or otherwise very personal<br />
processing<br />
• Large-scale data processing<br />
• Merging data sets<br />
• Processing of vulnerable personal data<br />
• Application of new technical or organizational solutions or innovative<br />
use<br />
6.1. The general information contained in the location data impact assessment prepared by the controller<br />
compliance with Article 35 (1) and (7) of the Protection Regulation<br />
The registrar processes location information in connection with its MTI taxi brokerage software. It is<br />
the MTI system before the application of the General Data Protection Regulation. Location-<br />
an impact assessment on data processing was prepared on 4 December 2019. The impact assessment is<br />
thus drawn up when the matter under consideration has already been pending and the processing of personal data has taken place<br />
during the period of application of the General Data Protection Regulation for about one and a half years. <br />
9 Guidance from the Data Protection Working Party on data protection impact assessments and ways to find out<br />
‘high risk’ within the meaning of Regulation (EU) 2016/679 of 4 April 2017,<br />
revised and approved on 4 October 2017, p. 10 ff <br />
The controller has not identified this in its impact assessment on the processing of location data<br />
in accordance with Article 35 (7) (a) of the General Data Protection Regulation.<br />
the basis on which it processes personal data. A legitimate interest refers to a<br />
one of the specific interests pursued by the controller<br />
by means of data processing. Instead, the controller has recorded in the impact assessment<br />
the purpose of the processing and the need for the processing of personal data. For example,<br />
with regard to the process, it should be noted that customer relationship management, or the<br />
existence of a process, is not a legitimate interest of the controller.<br />
By contrast, the controller is not covered by Article 35 (7) (b) of the General Data Protection Regulation.<br />
assessed the proportionality of its processing operations as required by that processing<br />
purposes. Assessing the proportionality of the processing operations requires the Data Protection Team<br />
According to the Guidelines on Data Protection Impact Assessment 10, on the one hand, the<br />
on the one hand, and the characteristics of the personal data processed on the other, in particular<br />
in accordance with Article 5 (1) (c) and (e) of its Data Protection Regulation. In particular,<br />
the personal data processed are missing from the impact assessment provided by the controller<br />
assessment and justification of the general data protection regulation’s principle of minimization and<br />
in accordance with the principle of subsidiarity. <br />
According to Article 35 (7) (c) of the General Data Protection Regulation<br />
shall include an assessment of the rights and freedoms of data subjects referred to in paragraph 1.<br />
vista risks. According to the instructions of the Data Protection Group, risk means a scenario in which:<br />
describe the event and its consequences and assess their severity and probability. 11<br />
In a data protection context, risk can thus be described as a real-life event that typically has<br />
negative effects on the exercise of the data subject's rights and freedoms. These events<br />
and their consequences have varying degrees of severity and probability. The registrar does not<br />
has not included in its assessment such scenarios or real-life events that would constitute<br />
risk to the data subject’s rights, even though the controller has<br />
the origin, nature, severity, risk management, threats and<br />
measures taken. Thus, they have not in fact been explicitly defined by the controller.<br />
risks to the controller’s rights and freedoms<br />
in accordance with Article 35 (7) (c) of the General Data Protection Regulation. <br />
In its assessment, the controller has identified measures that could<br />
measures pursuant to Article 35 (7) (d) of the General Data Protection Regulation.<br />
you to address the risks. However, these recorded measures cannot be taken into account<br />
assessing whether the controller’s impact assessment on the processing of location data<br />
substantive requirements of the General Data Protection Regulation, as there is no controller<br />
the risks associated with the processing of personal data have been properly identified as described above.<br />
In the absence of a definition of risks, there are also no related management and other measures<br />
possible to define in accordance with the General Data Protection Regulation.<br />
For the reasons set out above, the Assistant EDPS considers that it is not provided by the controller<br />
in the Impact Assessment on Data Protection on the Processing of Location Data<br />
shortcomings and has not been drafted in a timely manner in accordance with Article 35 (1) of the General Data Protection Regulation.<br />
in accordance with Similarly, the impact assessment does not comply with Article 35 of the General Data Protection Regulation.<br />
the conditions set out in paragraph 7 of this Article. <br />
10 Data Protection Panel Impact Assessment Guide, Annex 2, p. 26<br />
11 Data Protection Team Impact Assessment Guide, p. 7<br />
6.2. Preparation of a data protection impact assessment on security camera surveillance in taxis<br />
cars under Article 35 (1) of the General Data Protection Regulation<br />
Elsewhere in his report, the controller has indicated that it deals with security camera surveillance.<br />
at least in the part covered by its transmission<br />
in taxi cars, in addition to image data, audio data for monitoring purposes. That personal information<br />
the purpose has been, as indicated by the controller, mainly to drivers and passengers<br />
safety and working conditions for drivers. For the purpose of that processing,<br />
the registrar has also identified damage situations and safety endangerment situations<br />
settlement. In addition, the controller has defined the purpose of the processing as<br />
control of their activities. <br />
The processing of personal data in the context of security camera surveillance is objective<br />
as a whole is about control. Collection of security cameras installed in taxi cars<br />
information can be used to verify a variety of security, personal and<br />
property damage and criminal incidents, as well as in taxi cars and their vicinity.<br />
events and practices more generally. Security by the controller<br />
camera surveillance must be considered systematic, as it has been introduced in all Taxi<br />
in taxi cars covered by the ham and carried out in a uniform manner in the continuous recording<br />
with security cameras. <br />
According to the Data Protection Working Party, sensitive or highly personal information does not 12<br />
limited to specific categories of personal data under Article 9 of the General Data Protection Regulation.<br />
information on convictions or infringements referred to in Article 10. sensitivity of<br />
information of a very personal nature also covers others in a general sense<br />
sensitive personal data as they relate to household and private activities,<br />
or because they affect the exercise of a fundamental right or because their infringement involves<br />
clearly on the daily life of the registered person. <br />
It must be considered probable that, in the context of security camera surveillance,<br />
very personal information. For example, a telephone conversation during a taxi ride or<br />
traveling in a particular company may transmit information on data subjects which<br />
could cause harm to the data subject in their normal life. In addition<br />
considered likely that the majority of data subjects were not aware that<br />
in the car in which they have traveled may have been collected in connection with security camera surveillance.<br />
audio data and therefore may not have been able to take this into account.<br />
in taxi cars in their behavior.<br />
On the basis of the controller’s report, the<br />
the processing of personal data as a whole must be considered large-scale. This is especially supported by<br />
the amount of personal data processed, the large number of data subjects affected, the<br />
the number of taxis covered and the number of taxi rides provided per year. large-scale<br />
In addition, security cameras must store personal data<br />
not only of the passenger who booked the taxi ride, but also of the passengers traveling with him.<br />
in which case it is likely that security camera surveillance will in fact be subject to multiple<br />
times the number of natural persons compared to the registrars who placed the order.<br />
röityihin. In addition, it should be noted that personal data processed by security camera surveillance<br />
are not limited to video and audio recordings of natural persons who are already<br />
collect a wealth of different types of personal information about natural persons traveling in taxi cars<br />
12 Guidance on the Impact Assessment of the Data Protection Team, p. 11<br />
persons. In addition, according to a report provided by the controller, security camera surveillance<br />
The image and sound recordings collected in this connection are time- and place-dependent, which can be<br />
considered to further increase the amount of personal data processed, but also to emphasize<br />
the possible effects of the processing of personal data on data subjects. The duration and permanence of personal<br />
the report provided by the controller shows that the<br />
is part of its normal activities and the processing of personal data. The registrar is<br />
has taken steps to ensure that security camera audio recording is turned off<br />
off in December 2019. The geographical scope of the registrar's business is<br />
focused on the information available on its website for the Helsinki metropolitan area, but<br />
There are also taxi cars available elsewhere in Finland. The registrar is Finland’s largest taxi<br />
ride brokerage company. <br />
In addition, the data protection risk assessment of security camera surveillance shall take into account at least:<br />
processing of data on vulnerable data subjects. In a weaker<br />
there is an imbalance between the power relations between the data subjects and the controller;<br />
which may manifest itself, for example, as difficulties for vulnerable data subjects, or<br />
inability to exercise their data protection rights. Taxi ride services are provided<br />
in principle for all categories of persons and security camera surveillance is therefore<br />
children and the elderly, for example. Particularly disadvantaged<br />
the group of registered persons consists of taxi drivers who are employed in the<br />
with the motorist partners of the registrar. <br />
For the reasons set out above and in the light of the four Data Protection Working Groups, the<br />
that the security camera surveillance carried out by the controller<br />
Article 35 (1) of the General Data Protection Regulation<br />
rights and freedoms of the individual and should have been the subject of an information<br />
data protection impact assessment before initiating the procedure under assessment.<br />
and the controller has not been able to demonstrate compliance with that paragraph of<br />
in accordance with Article 5 (2) of the General Data Protection Regulation.<br />
Similarly, since the obligation to carry out an impact assessment can already be demonstrated by the<br />
As regards Article 35 of the basic Regulation, it is not necessary to examine whether the same processing operation should have been<br />
protection impact assessment on other grounds.<br />
The EDPS draws attention to the fact that automatic decision-making,<br />
including profiling, it is not appropriate to comply with Article 22 of the General Data Protection Regulation.<br />
appropriate before carrying out an impact assessment.<br />
6.3. The data protection impact assessment for the controller loyalty program<br />
automatic decision-making, including profiling<br />
The application of Article 35 (3) (a) of the General Data Protection Regulation requires that:<br />
automatic processing, such as profiling, involves the personal identification of a natural person<br />
systematic and comprehensive assessment of the risks and that such automatic processing<br />
decisions which have legal effects on or affect a natural person<br />
to a natural person in a similar way significantly. Article 35 of the General Data Protection Regulation<br />
The list in paragraph 3 of the Directive is not exhaustive as described above, but the data protection impact.<br />
should also be carried out in other cases where the processing of personal data is likely to<br />
poses a high risk to the data subject's rights and freedoms<br />
taking into account the nature, extent, context and purposes of the processing. <br />
On the basis of the controller’s report, the personal data processed by it shall be<br />
including profiling, are limited to telephone numbers,<br />
orders placed with the application and whether the registrant has reached VIP level.<br />
A systematic and comprehensive assessment of a person’s personal characteristics<br />
with regard to the requirement for automatic decision-making, it should be noted that<br />
including profiling, the assessment of personal characteristics is limited to practical<br />
how often a particular person uses a taxi.<br />
Although the personal data carried out by the controller in connection with that processing operation<br />
the evaluation of the features takes place with each taxi order and can thus be considered<br />
systematic, not for taxi orders made by telephone or by means of an ordering application, their<br />
and the processing of VIP customer data can be considered as Article 35 of the General Data Protection Regulation.<br />
comprehensive characteristics of a natural person within the meaning of Article 3 (3) (a)<br />
evaluation. Since the first subparagraph of Article 35 (3) (a) of the General Data Protection Regulation<br />
the two cumulative requirements of this Directive are not met, its second registered requirement<br />
black, that is, the automatic decision - making of a decision with legal effect, or<br />
other significant effects should not be assessed in this context.<br />
For the reasons described above, the EDPS considers that the controller should not have come<br />
prepare a data protection impact assessment in accordance with Article 35 (3) of the General Data Protection Regulation<br />
in accordance with point (a). It remains to be seen whether it should have been drafted on data protection<br />
impact assessment pursuant to Article 35 (1) of the General Data Protection Regulation, ie if the<br />
processing of personal data may be considered likely to pose a high risk to natural<br />
freedoms and rights of the individual, taking into account the nature, scope, context and purposes of the processing<br />
taking.<br />
When assessing the obligation of the controller to carry out a data protection impact assessment<br />
pursuant to Article 35 (1) of the Data Protection Regulation, the Assistant Data Protection Supervisor<br />
pay attention to the personal characteristics defined by the Data Protection<br />
evaluation and scoring criteria, automatic decision-making<br />
has legal effects or similar significant effects on the large-scale processing of data<br />
and the processing of registered data on vulnerable data subjects.<br />
criteria.<br />
With regard to assessment and scoring based on personal characteristics,<br />
as described above, personal data processed in the context of automatic decision-making<br />
Dots manifest a person's qualities in terms of something other than the practice of how often he or she<br />
use taxi services. Based on the report provided by the registrar, it does not process<br />
other such information from registrants in the automated version of the loyalty program.<br />
in the context of its decision-making. On the basis of a report provided by the registrar, the VIP<br />
verification of the battery and the provision of its benefits to suitable persons<br />
the scoring of data subjects based on the number of taxi orders it places, no taxi service<br />
the frequency of use of the services is not apparent from the number of employees in the loyalty program.<br />
with regard to data processing, other than the verification of VIP membership. Apulaistieto-<br />
the EDPS considers that the processing of personal data concerning the scoring of persons does not occur<br />
likely high risk to the rights and freedoms of data subjects.<br />
Automatic decision-making, including profiling, based on tasks registered<br />
the legal and other significant effects of decisions on<br />
and the group has considered that such effects include, for example, outside individuals<br />
or discrimination, and the conditions of the criterion are not met if the effects of the treatment are natural <br />
persons are few or non-existent. 13 The controller has considered in his reply<br />
6.3.2020 that the processing in question has no legal or other significant effects on the<br />
the data subjects. <br />
The EDPS notes that the decisions taken on the basis of this processing operation<br />
The actual effects of these are in principle limited to the fact that the person ordering the taxi receives<br />
a taxi ride either faster, slower or in an extreme case where he is queued in front of him<br />
becomes only VIP customers, he will only receive a taxi forwarded by the registrar for a long time<br />
after or not at all. Based on the effects described above, the Assistant Data Protection Supervisor<br />
Considers that this processing of personal data has mainly only a minor effect on the<br />
given that the controller has significant market power.<br />
Despite this, other taxi drivers and taxi services are also available<br />
service providers. The effects of such processing of personal data could be greater,<br />
if the services provided by the controller were the only pick-up services used by a particular group<br />
environment.<br />
The assessment of a large-scale processing must take into account, on the one hand, that the<br />
only limited types of personal data are covered. On the other hand, the processing of personal data<br />
the amount can be considered large. According to the controller’s report, the controller’s<br />
The center handles around four million taxi rides a year, with the majority of orders coming from digital<br />
subscription channels and about a third by telephone. In this case,<br />
taxi orders and the associated automatic processing of VIP-customers<br />
more than a million times a year. In addition, taking into account the<br />
processing of personal data can be considered as large-scale in this respect.<br />
In addition, it should be noted that this processing is part of the controller’s normal<br />
processing of personal data and has lasted since September 2018 as indicated by the controller.<br />
Kaen. 14 The geographical implications of the processing of the controller’s personal data are<br />
the metropolitan area, but the services it provides are available to both its registered<br />
may be located elsewhere. Automatic decision-making, including profiling,<br />
processing of personal data in the context of a controller loyalty program is<br />
as a whole.<br />
With regard to the processing of data relating to vulnerable data subjects, it may be<br />
as has been pointed out above with regard to security camera surveillance, that the controller is dealing with<br />
data on data subjects likely to be in that position. Automatic decision making,<br />
including profiling, it should also be noted that persons in this position<br />
may not be able to exercise their right to oppose the automatic decision against them.<br />
-making. <br />
If the condition specified by the two Data Protection Groups is met, the Assistant Data Protection Commissioner<br />
Considers that automatic decision-making by the controller, including<br />
profiling is likely to pose a high risk to the rights and<br />
pauksille. Accordingly, the EDPS considers that the controller should have drawn up<br />
automatic decision-making in the context of its loyalty program, in accordance with<br />
including profiling, in accordance with Article 35 (1) of the General Data Protection Regulation<br />
impact assessment before proceeding, taking into account the treatment<br />
nature, scope, context and purposes. Consequently, the controller has not been able to<br />
13 Data Protection Team Impact Assessment Guide, p. 10<br />
14 Registrar's press release on 6 September 2018https://www.taksihelsinki.fi/taksi-helsinki-oy/ajankohtaista/lehdis-<br />
release on / taxi-helsinki-launching a customer loyalty program-perched-sitting-vip customer /<br />
to demonstrate compliance with that paragraph of Article 5 of the General Data Protection Regulation<br />
In accordance with paragraph 2.<br />
Summary of the decision of the Assistant Data Protection Supervisor<br />
As described above, the processing of the controller’s personal data has revealed a general data protection<br />
serious shortcomings in compliance with this Regulation. The processing of personal data does not<br />
the processing conditions provided for in Articles 5, 6, 12, 26, 28, 30 and 35 of the Regulation. So extensive<br />
shortcomings in the processing of personal data are also reflected in Article 25 of the General Data Protection Regulation<br />
procedure and shortcomings in the built-in and default data protection<br />
technical and organizational measures required by Article 24. <br />
Signatures<br />
The Assistant <br />
_________________________<br />
Anu Talus<br />
Inspector general <br />
_________________________<br />
Jyri Poutala <br />
Decision of the Sanctions Chamber on the imposition and amount of the sanction fee<br />
Having regard to the decision of the Assistant Data Protection Supervisor on the infringement of the Regulation<br />
overall, the infringements reflect serious deficiencies in the processing of personal data.<br />
under Article 83 of the General Data Protection Regulation.<br />
effective, proportionate and dissuasive sanction<br />
imposition of a levy.<br />
The Sanctions Chamber of the Office of the Data Protection Officer lays down a general data protection regulation 58<br />
accordance with Article 83 (2) (i) of the General Data Protection Regulation and Article 83 of the<br />
pursuant to section 24 of the Data Protection Act to the registrar 72,000.00 (seventy-two thousand) euros<br />
administrative penalty to be paid to the State. <br />
In assessing the amount of the administrative penalty fee, account has been taken of the<br />
aggravating and mitigating factors in accordance with Article 83 (2) thereof.<br />
The controller has not responded to the EDPS’s request for a hearing.<br />
that the corona situation would be a factor in reducing the administrative penalty.<br />
However, in assessing the amount of the administrative penalty payment, the<br />
exceptional situation. It is common knowledge that the corona situation is<br />
significantly into taxi operations. As these effects are not yet visible in the Sanctions<br />
be from the available information on the turnover of Taxi Helsinki, is the Sanctions College<br />
generally considered the effects of the corona situation as reducing the amount of the penalty payment<br />
factor. An administrative penalty fee is enforced, such as the execution of a fine<br />
(672/2002).<br />
Grounds for the decision of the Sanctions Chamber<br />
Pursuant to Article 58 (2) (i) of the General Data Protection Regulation, each supervisory authority<br />
the Authority has the remedial power to impose an administrative fine under Article 83 here<br />
in addition to or instead of the measures referred to in paragraph 1, in each individual case<br />
depending on its circumstances.<br />
According to Article 83 (1) of the General Data Protection Regulation, each supervisory authority must:<br />
ensure that the imposition of administrative fines for infringements of this Regulation<br />
in accordance with this Article in each individual case<br />
relationships and cautionary.<br />
Under Article 83 (2) of the General Data Protection Regulation, administrative fines are imposed<br />
in accordance with the circumstances of each individual case in Article 58 (2) (a) to (h) and (j)<br />
in addition to or instead of the measures referred to in When deciding on the imposition of an administrative fine,<br />
the amount of the administrative fine must be taken in each individual case<br />
take due account of the following:<br />
(e) the nature, gravity and duration of the infringement, the nature, extent or purpose of the processing in question;<br />
the number of data subjects affected by the infringement.<br />
and the extent of the damage suffered by them;<br />
(f) willful misconduct or negligence;<br />
(g) the action taken by the controller or the processor on data subjects;<br />
to mitigate the damage caused; <br />
(h) the degree of responsibility of the controller or the processor, taking into account their 25<br />
and the technical and organizational measures it has taken pursuant to Article 32; <br />
(i) any previous similar breaches by the controller or the processor; <br />
(j) the degree of cooperation with the supervisory authority in order to remedy the infringement and<br />
to mitigate adverse effects; <br />
(k) the categories of personal data affected by the breach; <br />
(l) the manner in which the infringement came to the notice of the supervisory authority, in particular<br />
the controller or processor of the breach and to what extent; <br />
(m) if the controller or processor concerned has previously been designated<br />
measures referred to in Article 58 (2) on the same subject, those measures<br />
compliance; <br />
(n) approved codes of conduct pursuant to Article 40 or approved codes of conduct pursuant to Article 42;<br />
compliance with ignited certification mechanisms; and<br />
(o) any other aggravating or mitigating factors applicable to the case, such as the<br />
any financial advantage derived directly or indirectly from the Commission or any<br />
losses incurred.<br />
Pursuant to Article 83 (3) of the General Data Protection Regulation, if the controller or the<br />
intentionally or negligently infringes the processing operations in the same or related processing operations.<br />
several provisions of this Regulation, the total amount of the administrative fine shall not exceed<br />
the fine imposed for the most serious infringement. <br />
Pursuant to Article 83 (5) of the General Data Protection Regulation, infringements of the following<br />
an administrative fine of up to EUR 20 000 000 shall be imposed in accordance with paragraph 2,<br />
or, in the case of an undertaking, 4% of its annual worldwide<br />
whichever is the greater: <br />
(a) the basic principles of processing referred to in Articles 5, 6, 7 and 9, the conditions for<br />
including operations;<br />
(b) the rights of data subjects in accordance with Articles 12 to 22; <br />
According to Article 24 of the Data Protection Act, the administrative procedure provided for in Article 83 of the Data Protection Regulation<br />
the fine (administrative penalty fee) shall be imposed by the Data Protection Officer and the<br />
a panel of sanctions formed jointly by the parties. The Data Protection Officer shall act on the<br />
Chairman. <br />
Consultation of the controller on the imposition of a penalty fee<br />
The controller has been consulted on the imposition of a penalty fee in a supplementary report submitted on 13 February 2020.<br />
request for consultation and consultation. In its reply of 6 March 2020, the controller submitted<br />
I find that the conditions for imposing a penalty payment are in no way met. Re-<br />
The Registrar considers that, in addition to rectifying the shortcomings identified in this case,<br />
swing note. In this respect, the controller refers to the Office of the Data Protection<br />
previous decisions which, in addition to rectifying deficiencies, have been sanctioned<br />
mautus.<br />
• In the case of security cameras, the controller considers that the imposition of a penalty fee<br />
Article 83 (2) of the General Data Protection Regulation.<br />
basis<br />
pay attention<br />
specially<br />
the following<br />
following:<br />
In the light of the explanation provided, the potential infringement has been minor and<br />
short-lived and no damage has been shown; <br />
• The possible violation has not been intentional and at most slightly negligent; <br />
________________________________________<br />
Page 31<br />
31 (35)<br />
Office of the Data Protection Officer<br />
PO Box 800, FI-00531 Helsinki - tel. +358 29 566 6700 (exchange) - tietosuoja@om.fi - www.tietosuoja.fi<br />
• The controller has taken immediate action to remedy a possible breach.<br />
and mitigate adverse effects; <br />
• The data controller has himself informed the data subject of the possible infringement and its<br />
jaustoimista; <br />
• The controller has cooperated with TSV and taken steps to remedy the breach<br />
as well as to alleviate possible side effects, an immediate first TSV has been performed<br />
Taxi after a request for clarification to Helsinki; and<br />
• Taxi Helsinki has not committed any previous violations. <br />
For matters other than security cameras, the controller shall consider that the penalty fee<br />
Article 83 (2) of the General Data Protection Regulation<br />
the following points in particular:<br />
• In view of the explanation provided in the case, the possible infringement has been minor and not<br />
no damage has been shown; <br />
• The possible violation has not been intentional and at most slightly negligent; <br />
• Taxi Helsinki has immediately taken steps to rectify the possible violation<br />
and mitigate adverse effects; <br />
• Taxi Helsinki has co-operated with TSV to rectify the infringement and<br />
to mitigate possible adverse effects; and<br />
• Taxi Helsinki has not committed any previous violations. <br />
Assessment of the imposition of a penalty payment<br />
In accordance with Article 83 (1) of the General Data Protection Regulation, the imposition of a fine<br />
taking into account the specificities of the case at hand. registration<br />
In the course of the consultation, the EDPS has referred to previous decisions of the EDPS Office.<br />
in cases where no penalty payment has been imposed but the penalty has been imposed<br />
processing of personal data of the country in accordance with the General Data Protection Regulation and the note issued.<br />
Such decisions shall not have wider legal effects and<br />
consideration of the framework is made on a case-by-case basis. The amount of the penalty payment<br />
In this individual case, the decision to<br />
infringements of the General Data Protection Regulation decided by the EDPS and the<br />
on the basis of the information provided for in<br />
The administrative penalty payment must be effective, proportionate and dissuasive in the individual case<br />
deterrent. As regards efficiency, it should be noted that in the present case<br />
a mere provision under Article 58 (2) (d) of the General Data Protection Regulation<br />
sufficient consequence of the controller’s processing of personal data in breach of the General Data Protection Regulation.<br />
taking into account the Proceedings against the controller’s general data protection regulation are<br />
serious shortcomings in the General Data Protection Regulation and the data subject<br />
rights and freedoms. Apulaistietosuojavaltuu-<br />
According to the above summary, these shortcomings reflect the requirements of the General Data Protection Regulation.<br />
more comprehensive anti-trust procedure. An administrative penalty fee may be<br />
considers it an effective way to address the failure of the controller to intervene in the<br />
obligations under this Decision under the General Data Protection Regulation.<br />
neglect of victories. <br />
The amount of the administrative penalty payment shall be proportionate to the<br />
the business of the registrar and its financial situation. The administrative penalty fee<br />
account shall be taken of the annual worldwide accounts of the controller for the preceding financial year.<br />
konaisliikevaihto. In its reply of 6 March 2020, the registrar has stated the previous financial year<br />
________________________________________<br />
Page 32<br />
32 (35)<br />
Office of the Data Protection Officer<br />
PO Box 800, FI-00531 Helsinki - tel. +358 29 566 6700 (exchange) - tietosuoja@om.fi - www.tietosuoja.fi<br />
total turnover of EUR 10.1 million. Financial statements for the previous financial year, ie 2019<br />
had not yet been completed on the basis of the controller's reply. Notified by the controller<br />
the revenue data for the financial year 2019 must be considered credible as provided by the registrar<br />
According to the 2018 financial statements, net sales in 2018 were EUR 8.792 million and in 2017<br />
EUR 7.325 million.<br />
The administrative penalty payment must be dissuasive in nature. Monetary<br />
The imposition of a fee shall have such an economic effect on the controller that:<br />
it is not indifferent to its business. The sanction should motivate the<br />
to avoid future breaches of the General Data Protection Regulation. <br />
Assessment of the maximum amount of the penalty payment<br />
The Assistant Data Protection Supervisor has considered in his decision that the controller had acted<br />
Articles 5, 6, 12, 26, 28, 30 and 30 of the General Data Protection Regulation.<br />
Articles 35 and 25 of the General Data Protection Regulation<br />
procedure contrary to this Article. <br />
Of these, breaches of Articles 5, 6 and 12 are the most serious breaches of the general data protection<br />
higher penalty category in accordance with Article 83 (5) of the Regulation. <br />
Consequently, the maximum amount of the administrative penalty applicable is determined by the general rules<br />
in accordance with Article 83 (5) of the Data Protection Regulation and shall not exceed the<br />
pursuant to Article 83 (3) of the Regulation.<br />
Assessment of aggravating and mitigating circumstances<br />
The nature, gravity and duration of the infringement, the nature, extent or purpose of the processing in question<br />
the number of data subjects affected by the infringement and to them<br />
the amount of damage caused<br />
Mitigating circumstances in accordance with Article 83 (2) (a) of the General Data Protection Regulation<br />
on the one hand, the fact that the controller has dealt with security camera surveillance can be considered as branches<br />
audio data for a limited time. In addition, the controller has undertaken security camera<br />
following a request for clarification addressed to it.<br />
On the other hand, the controller should have assessed and placed in the context of security camera surveillance<br />
processing of persons in accordance with the general data protection regulation by the time<br />
when the General Data Protection Regulation came into force, and to take into account and ensure its requirements<br />
before the introduction of new devices with sound recording.<br />
It should also be borne in mind that the processing of personal data is a key condition for<br />
the business of the controller and has acted in breach of the general data protection regulation<br />
systematically in the normal course of business. The controller shall process the<br />
and the processing of personal data involves a significant number of data subjects and<br />
kilötietotyyppejä. <br />
Damage to data subjects is limited to the availability of personal data concerning them<br />
processed unlawfully, which is likely to create a sense of insecurity and privacy.<br />
feeling of loss of protection. Likewise, the general privacy regulation of the controller<br />
As a result of the antitrust proceedings, data subjects have been in a worse position to control them<br />
the lawfulness of the processing of personal data concerning In addition, account must be taken of<br />
the fact that the controller can be considered as processing in the normal way <br />
________________________________________<br />
Page 33<br />
33 (35)<br />
Office of the Data Protection Officer<br />
PO Box 800, FI-00531 Helsinki - tel. +358 29 566 6700 (exchange) - tietosuoja@om.fi - www.tietosuoja.fi<br />
information on vulnerable data subjects. For registered<br />
no financial damage has been identified during the investigation. <br />
Intentional or negligent infringement<br />
Proceedings contrary to the controller's regulation must be considered negligent. productivity<br />
the imposition of an administrative penalty must be regarded as<br />
as a supporting factor. Aggravating in terms of imposing an administrative penalty payment<br />
it may be considered that, pending the outcome of the case, the controller 's conduct is<br />
revealed a number of fundamental shortcomings in the processing of personal data.<br />
Actions taken by the controller or processor of data subjects<br />
to mitigate the damage<br />
As mitigating circumstances for the imposition of a penalty payment, account shall be taken of<br />
the registrar has voluntarily discontinued and sought to ensure that the security camera surveillance<br />
no longer process audio files and has, on the basis of its report, committed itself to<br />
to share shortcomings in the processing of personal data. On the other hand, it should be noted that<br />
the controller has taken action and is committed to rectifying the deficiencies only to the controller<br />
following a request for clarification. <br />
For other irregularities, the fact that the<br />
by or after the date of application of this Regulation.<br />
that the processing of personal data would comply with the general data protection regulation.<br />
The degree of responsibility of the controller or processor, taking into account their 25 and 32<br />
technical and organizational measures taken pursuant to this Article <br />
The mitigating liability of the controller may be considered to be the measures it indicates<br />
before and during the investigation. On the other hand, the<br />
breaches of the protection regulation show serious disregard for the processing of personal data<br />
the effects on data subjects, in which case the security of processing<br />
subsequent measures have not been based on a proper assessment.<br />
Any previous similar breaches by the controller or processor <br />
There are no previous similar infringements against the controller.<br />
Degree of cooperation with the Authority to remedy the breach and its possible<br />
to mitigate side effects<br />
A mitigating circumstance is that the controller may be considered to have acted in a<br />
in cooperation with the Authority and on the basis of its report<br />
remedial action.<br />
Groups of personal data affected by the breach<br />
An aggravating circumstance is the fact that the controller deals with large-scale<br />
personal data relating to data subjects. In particular, location and imagery of data subjects<br />
and there is a higher than usual risk involved in processing audio data. <br />
________________________________________<br />
Page 34<br />
34 (35)<br />
Office of the Data Protection Officer<br />
PO Box 800, FI-00531 Helsinki - tel. +358 29 566 6700 (exchange) - tietosuoja@om.fi - www.tietosuoja.fi<br />
The manner in which the breach came to the attention of the supervisory authority, in particular whether the controller reported<br />
or the controller of the personal data breach and to what extent <br />
The Office of the Data Protection Officer was initially informed of the case concerning the controller.<br />
dose made by the anonymous registrant concerned. The case concerning the controller<br />
and was opened as an own-initiative inquiry.<br />
Any other aggravating or mitigating factors applicable to the case, such as the<br />
any economic advantage derived directly or indirectly from the infringement or any<br />
losses<br />
A mitigating circumstance may be considered to be the fact that the controller has<br />
demonstrated its commitment to improving its data protection in the future.<br />
In the light of the above, the Sanctions Chamber of the Office of the Data Protection Officer<br />
proceedings against the controller in the context of the general data protection regulation<br />
in accordance with Article 58 (2) (d) of the General Data Protection Regulation<br />
in accordance with Article 58 (2) (i) of the General Data Protection Regulation<br />
administrative penalty fee.<br />
The College of Sanctions considers that the infringements of the General Data Protection<br />
effective, proportionate and dissuasive penalty<br />
EUR 72,000.00 (seventy-two thousand).<br />
Applicable law<br />
The explanatory memorandum shows.<br />
Appeal<br />
According to section 25 of the Data Protection Act (1050/2018), the Deputy Data Protection Commissioner and the Sanctions Chamber<br />
decisions may be appealed to an administrative court in accordance with the law of the<br />
administrative proceedings (808/2019). The appeal is made to the administrative court.<br />
The notice of appeal is attached.<br />
Service<br />
The decision will be notified by post in accordance with section 60 of the Administrative Procedure Act (434/2003)<br />
against.<br />
More information <br />
For more information on this decision, please contact Anu Talus, Deputy Data Protection Commissioner, anu.talus@om.fi. <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=IP_-_07120-1/2020/358&diff=10502IP - 07120-1/2020/3582020-06-09T16:52:47Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Slovenia<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoSI.png<br />
|DPA_Abbrevation=IP<br />
|DPA_With_Country=IP (Slovenia)<br />
<br />
|Case_Number_Name=07120-1/2020/358<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Informacijski Pooblaščenec<br />
|Original_Source_Link_1=https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1634<br />
|Original_Source_Language_1=Slovenian<br />
|Original_Source_Language__Code_1=SL<br />
<br />
|Type=Advisory Opinion<br />
|Outcome=<br />
|Date_Decided=18.05.2020<br />
|Date_Published=<br />
|Year=2020<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 5(1)(b) GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR#1b<br />
|GDPR_Article_2=Article 6(4) GDPR<br />
|GDPR_Article_Link_2=Article 6 GDPR#4<br />
|GDPR_Article_3=Article 9(2)(c) GDPR<br />
|GDPR_Article_Link_3=Article 9 GDPR#2c<br />
|GDPR_Article_4=Article 9(2)(h) GDPR<br />
|GDPR_Article_Link_4=Article 9 GDPR#2h<br />
|GDPR_Article_5=Article 9(2)(j) GDPR<br />
|GDPR_Article_Link_5=Article 9 GDPR#2j<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
In a non-binding opinion, the Slovenian DPA (IP), stated that its National Institute of Public Health (NIJZ) could use data from its infectious database to invite COVID-19 survivors to participate in another body's treatment and research trials which involved the collection of their data. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The NIJZ, using its Infectious Diseases Register, contacted 48 individuals who had survived COIVD-19. <br />
The NIJZ contacted these individuals to invite them to visit the Institute of Transfusion Medicine (ZTM), who were investigating the treatment of critically ill COVID-19 patients and needed the blood of individuals who had survived the disease in order to conduct its research. <br />
<br />
=== Dispute ===<br />
Under GDPR rules, can the NIJZ use the data in its Infectious Diseases Register to invite data subjects to participate in another body’s treatments and give that body their health data?<br />
<br />
=== Holding ===<br />
The IP said that the NIJZ was allowed to use the data it had to invite patients to participate in the ZTM's research and data collection. <br />
<br />
To illustrate how the GDPR could be applied to allow the NIJZ data to be used in this way, the IP cited examples from Article 9(2) GDPR, which lists the exceptions to the prohibition of processing special categories of data. <br />
The examples used were the following:<br />
• Article 9(2)(c), where the patient is physically incapable of giving consent because they are seriously ill, and processing is necessary prevent further deterioration of health;<br />
• Article 9(2)(h), where research involving persons who have survived COVID-19 patients is necessary for providing healthcare;<br />
• Article 9(2)(j), which permits processing for scientific research purposes related to treatments. <br />
<br />
For the secondary processing of the patients’ contact details, the IP suggested that under Article 6(4) GDPR, the NIJZ would be permitted to do so because of the link between the purpose of the initial collecting of the data (the keeping of infectious disease records) and the purposes of the intended further processing (the monitoring of infectious diseases and their characteristics). <br />
<br />
The IP also noted that further processing for scientific research purposes is permitted under Article 5(1)(b) GDPR, and recalled that Recital 159 GDPR provides that “the processing of personal data for scientific research purposes should be interpreted in a broad manner”. <br />
<br />
<br />
== Comment ==<br />
The IP has issued similar opinions on:<br />
• the use of data to obtain consent (0712-18 / 2012/2)<br />
• sending consent invitations for another entity (0712-571 / 2010/2)<br />
<br />
However, it distinguished its opinion here with its opinion in 0712-1 / 2018/1780, where the IP stated that invitations for revaccination would not be permitted under the GDPR. <br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.<br />
<br />
<pre><br />
Date: 18.05.2020<br />
Title: Use of data from the legal database for the purpose of inviting patients to participate in treatment or research<br />
Number: 07120-1 / 2020/358<br />
Subject matter: Legal basis, Statistics and research, Medical personal data<br />
Legal act: Opinion<br />
<br />
On 13 May 2020, we received your question from the Information Commissioner (IP) on whether the NIJZ, on the basis of data from the REGISTER OF INFECTIOUS DISEASES no. According to the Health Care Databases Act (ZZPPZ), NIJZ 48 contacts persons who have survived COVID-19 with the intention of going to the selected personal physician and later to the Institute of Transfusion Medicine (ZTM) for blood collection for testing and treatment of critically ill patients with COVID-19. ZTM is investigating the treatment of severely ill patients with COVID-19 on the basis of plasma obtained from the blood of patients who have survived the disease, but has no data on these patients.<br />
<br />
On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter: the General Regulation on Data Protection), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter ZVOP-1) and Article 2 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP) provides our non-binding opinion on your issue.<br />
<br />
<br />
According to the IP, it is permissible for the NIJZ, on the basis of data in its own databases (eg Records of Infectious Diseases), to send to persons who have survived COVID-19 an invitation from the Institute of Transfusion Medicine to participate in research and treatment of seriously ill persons with COVID-19. 19.<br />
<br />
Explanations:<br />
<br />
In this case, it is a combination of internal processing of health data (in search of the target group) and contact data (in the invitation itself) of patients, which would be carried out for research purposes and the purpose of treating other persons and in such a way that ZTM knew which patients were involved, and patients would have complete freedom to be included in the research or treatment and the related processing of personal data.<br />
<br />
In the part of the processing relating to health data, the legal basis in a specific case may be (one or more):<br />
(c) point (2) of Article 9 of the General Data Protection Regulation, as it is indirectly about protecting the vital interests of seriously ill patients (ie preventing serious deterioration of health), and sick patients cannot physically give consent at this stage they have not yet been established;<br />
(h) point 2 of the second paragraph of Article 9 of the General Data Protection Regulation, because the search for surviving patients is indirectly (or in this, the first phase) necessary to provide medical care or treatment that would take place in accordance with national health regulations;<br />
(j) point (2) of the second paragraph of Article 9 of the General Data Protection Regulation, as processing is also necessary for scientific research purposes related to treatment.<br />
In the part of the processing relating to contact details, the legal basis in this case may be that it is a purpose compatible (see the fourth paragraph of Article 6 of the General Data Protection Regulation) with the basic purpose of keeping infectious disease records. the purpose is to monitor the occurrence of infectious diseases, their characteristics and the evaluation of measures). This applies both for research purposes and for the purpose of treating other persons. With regard to research, the General Data Protection Regulation itself provides in point (b) of the first paragraph of Article 5 that “further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) shall not apply. incompatible with the original purposes ”. The first paragraph of Article 17 of ZVOP-1 stipulates similarly, namely that, regardless of the original purpose of collection, personal data may be further processed for historical, statistical and scientific-research purposes. According to the 159th introductory recital of the General Data Protection Regulation, the processing of personal data for scientific research purposes should be interpreted broadly for the purposes of this Regulation (eg professional testing of a new treatment method may also be considered as research). In addition, obtaining consent or establishing contact for obtaining consent is already considered to be the first or at least the previous phase of the research process. And if this treatment can be performed by the controller in his own interest, there are no obstacles to him doing the same in the interest of another research organization, provided that the data on the invited patients are not disclosed to it.<br />
<br />
Although this is not exactly the same factual situation, we also refer to the already issued opinion IP no. 0712-18 / 2012/2 (use of data to obtain consents) and 0712-571 / 2010/2 (execution of sending consent invitations for another entity). At the same time, we clarify that this is not the same situation as in the negative opinion of IP no. 0712-1 / 2018/1780, which referred to invitations for revaccination.<br />
<br />
Best regards,<br />
<br />
Prepared:<br />
mag. Urban Brulc, Univ. dipl. right.<br />
independent IP consultant<br />
<br />
Mojca Prelesnik, B.Sc. dipl. right.<br />
Information Commissioner<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Data_Protection_in_France&diff=10501Data Protection in France2020-06-09T15:53:00Z<p>Juliette Leportois: /* Civil Courts */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |Data Protection in France<br />
[[Category:Country Overview]]<br />
|-<br />
| colspan="2" |[[File:fr.png|center|250px]]<br />
|-<br />
|Data Protection Authority:||[[CNIL (France)]]<br />
|-<br />
|National Implementation Law (Original):||[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006068624&dateTexte=20190212 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés]<br />
|-<br />
|English Translation of National Implementation Law:||[n/a English Translation]<br />
|-<br />
|Official Language(s):||French<br />
|-<br />
|National Legislation Database(s):||[https://www.legifrance.gouv.fr/ Légifrance]<br />
|-<br />
|English Legislation Database(s):||n/a<br />
|-<br />
|National Decision Database(s):||[https://www.legifrance.gouv.fr/ Link]<br />
|}<br />
<br />
==Legislation==<br />
===History===<br />
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés. <br />
<br />
===National constitutional protections===<br />
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996). <br />
<br />
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.<br />
<br />
===National GDPR implementation law===<br />
In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the L[https://www.legifrance.gouv.fr/eli/loi/2018/6/20/JUSC1732261L/jo/texte oi n° 2018-493 of 20 June 2018] , the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037277401&categorieLien=id Decree n° 2018-687 of 1st August 2018] which has been enacted to implement the aforementionned Law and lastly, the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037800506&categorieLien=cid Order n° 2018-1125 of 12 December 2018]. <br />
<br />
====Age of consent====<br />
The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".<br />
<br />
====Freedom of Speech====<br />
The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés". <br />
<br />
====Employment context====<br />
Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks. <br />
<br />
====Research====<br />
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés". <br />
<br />
====Other relevant national provisions and laws====<br />
The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law. <br />
<br />
===National ePrivacy Law===<br />
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004]. <br />
==Data Protection Authority==<br />
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.<br />
<br />
→ Profile: [[CNIL (France)]]<br />
==Judicial protection==<br />
===Civil Courts===<br />
The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts. <br />
<br />
===Administrative Courts===<br />
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "T''ribunal des conflits''"). <br />
<br />
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Council held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisdiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows uninterrupted video surveillance covering a public area. It is also well established that Administrative Courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc.. <br />
<br />
<u>The criteria can also be prescribed by law.</u><br />
<br />
The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial instance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, admissibility requirements can be found below:<br />
<br />
'''Regarding the decision''': it can be the lack of response or the notification of the CNIL's decision to the data subject<br />
<br />
*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29].<br />
<br />
*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6] of the Code of Administrative Justice,<br />
*The motion has to be sent jointly with the disputed decision according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2] of the same code,<br />
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted electronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5] of the same code,<br />
<br />
'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity<br />
<br />
In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists serious doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code. It can also apply to the CNIL decisions. <br />
<br />
You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].<br />
<br />
===Constitutional Council===<br />
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "''question prioritaire de constitutionnalité''"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Data_Protection_in_France&diff=10500Data Protection in France2020-06-09T15:48:13Z<p>Juliette Leportois: /* National ePrivacy Law */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |Data Protection in France<br />
[[Category:Country Overview]]<br />
|-<br />
| colspan="2" |[[File:fr.png|center|250px]]<br />
|-<br />
|Data Protection Authority:||[[CNIL (France)]]<br />
|-<br />
|National Implementation Law (Original):||[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006068624&dateTexte=20190212 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés]<br />
|-<br />
|English Translation of National Implementation Law:||[n/a English Translation]<br />
|-<br />
|Official Language(s):||French<br />
|-<br />
|National Legislation Database(s):||[https://www.legifrance.gouv.fr/ Légifrance]<br />
|-<br />
|English Legislation Database(s):||n/a<br />
|-<br />
|National Decision Database(s):||[https://www.legifrance.gouv.fr/ Link]<br />
|}<br />
<br />
==Legislation==<br />
===History===<br />
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés. <br />
<br />
===National constitutional protections===<br />
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996). <br />
<br />
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.<br />
<br />
===National GDPR implementation law===<br />
In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the L[https://www.legifrance.gouv.fr/eli/loi/2018/6/20/JUSC1732261L/jo/texte oi n° 2018-493 of 20 June 2018] , the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037277401&categorieLien=id Decree n° 2018-687 of 1st August 2018] which has been enacted to implement the aforementionned Law and lastly, the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037800506&categorieLien=cid Order n° 2018-1125 of 12 December 2018]. <br />
<br />
====Age of consent====<br />
The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".<br />
<br />
====Freedom of Speech====<br />
The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés". <br />
<br />
====Employment context====<br />
Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks. <br />
<br />
====Research====<br />
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés". <br />
<br />
====Other relevant national provisions and laws====<br />
The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law. <br />
<br />
===National ePrivacy Law===<br />
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004]. <br />
==Data Protection Authority==<br />
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.<br />
<br />
→ Profile: [[CNIL (France)]]<br />
==Judicial protection==<br />
===Civil Courts===<br />
The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts. <br />
<br />
===Administrative Courts===<br />
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits"). <br />
<br />
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Council held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc.. <br />
<br />
<u>The criteria can also be prescribed by law.</u><br />
<br />
The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial instance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, other admissibility requirements can be found below:<br />
<br />
'''Regarding the decision''': it can be the lack of response or the notification of the CNIL's decision to the data subject<br />
<br />
*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29].<br />
<br />
*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6],<br />
*The motion has to be sent jointly with the decision at stake according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2],<br />
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted electronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5]<br />
<br />
'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity<br />
<br />
In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists serious doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code. It can also apply to the CNIL decision. <br />
<br />
You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].<br />
<br />
===Constitutional Council===<br />
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Data_Protection_in_France&diff=10480Data Protection in France2020-06-09T11:32:21Z<p>Juliette Leportois: /* General information */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |Data Protection in France<br />
[[Category:Country Overview]]<br />
|-<br />
| colspan="2" |[[File:fr.png|center|250px]]<br />
|-<br />
|Data Protection Authority:||[[CNIL (France)]]<br />
|-<br />
|National Implementation Law (Original):||[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006068624&dateTexte=20190212 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés]<br />
|-<br />
|English Translation of National Implementation Law:||[n/a English Translation]<br />
|-<br />
|Official Language(s):||French<br />
|-<br />
|National Legislation Database(s):||[https://www.legifrance.gouv.fr/ Légifrance]<br />
|-<br />
|English Legislation Database(s):||n/a<br />
|-<br />
|National Decision Database(s):||[https://www.legifrance.gouv.fr/ Link]<br />
|}<br />
<br />
==Legislation==<br />
===History===<br />
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés. <br />
<br />
===National constitutional protections===<br />
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996). <br />
<br />
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.<br />
<br />
===National GDPR implementation law===<br />
In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the L[https://www.legifrance.gouv.fr/eli/loi/2018/6/20/JUSC1732261L/jo/texte oi n° 2018-493 of 20 June 2018] , the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037277401&categorieLien=id Decree n° 2018-687 of 1st August 2018] which has been enacted to implement the aforementionned Law and lastly, the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037800506&categorieLien=cid Order n° 2018-1125 of 12 December 2018]. <br />
<br />
====Age of consent====<br />
The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".<br />
<br />
====Freedom of Speech====<br />
The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés". <br />
<br />
====Employment context====<br />
Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks. <br />
<br />
====Research====<br />
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés". <br />
<br />
====Other relevant national provisions and laws====<br />
The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law. <br />
<br />
===National ePrivacy Law===<br />
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004]. <br />
==Data Protection Authority==<br />
<br />
===General information===<br />
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.<br />
<br />
→ Profile: [[CNIL (France)]]<br />
<br />
===Procedural information===<br />
<br />
====Applicable Procedural Law====<br />
The CNIL operates under the law "''Informatique et Libertés''" under the conditions laid down by Articles 19 to 29. See the law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 here], in French. The law "''informatique et Libertés''" has to be read jointly with the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29]. <br />
<br />
====Complaints Procedure under Art 77 GDPR====<br />
According to [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8, par.2 d)] of the loi "''Informatique et Liberté''", a data subject or their representative(s) can lodge a complaint with the CNIL regarding an alleged infringement of the GDPR. <br />
<br />
According to Article 10 of the Decree n°2019-536, the complaint will be deemed rejected if the CNIL did not reach the author of the complaint within a three months period, regarding its complaint - whatever the means-.<br />
<br />
====''Ex Officio'' Procedures under Art 57 GDPR====<br />
The CNIL can run ''ex officio'' procedures out of its own motion. Its powers are described under [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8] of the law "''Informatique et Libertés''".<br />
==Judicial protection==<br />
===Civil Courts===<br />
The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts. <br />
<br />
===Administrative Courts===<br />
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits"). <br />
<br />
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Council held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc.. <br />
<br />
<u>The criteria can also be prescribed by law.</u><br />
<br />
The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial instance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, other admissibility requirements can be found below:<br />
<br />
'''Regarding the decision''': it can be the lack of response or the notification of the CNIL's decision to the data subject<br />
<br />
*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29].<br />
<br />
*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6],<br />
*The motion has to be sent jointly with the decision at stake according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2],<br />
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted electronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5]<br />
<br />
'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity<br />
<br />
In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists serious doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code. <br />
<br />
You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].<br />
<br />
===Constitutional Council===<br />
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Data_Protection_in_France&diff=10477Data Protection in France2020-06-09T11:29:08Z<p>Juliette Leportois: /* Procedural information */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |Data Protection in France<br />
[[Category:Country Overview]]<br />
|-<br />
| colspan="2" |[[File:fr.png|center|250px]]<br />
|-<br />
|Data Protection Authority:||[[CNIL (France)]]<br />
|-<br />
|National Implementation Law (Original):||[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006068624&dateTexte=20190212 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés]<br />
|-<br />
|English Translation of National Implementation Law:||[n/a English Translation]<br />
|-<br />
|Official Language(s):||French<br />
|-<br />
|National Legislation Database(s):||[https://www.legifrance.gouv.fr/ Légifrance]<br />
|-<br />
|English Legislation Database(s):||n/a<br />
|-<br />
|National Decision Database(s):||[https://www.legifrance.gouv.fr/ Link]<br />
|}<br />
<br />
==Legislation==<br />
===History===<br />
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés. <br />
<br />
===National constitutional protections===<br />
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996). <br />
<br />
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.<br />
<br />
===National GDPR implementation law===<br />
In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the L[https://www.legifrance.gouv.fr/eli/loi/2018/6/20/JUSC1732261L/jo/texte oi n° 2018-493 of 20 June 2018] , the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037277401&categorieLien=id Decree n° 2018-687 of 1st August 2018] which has been enacted to implement the aforementionned Law and lastly, the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037800506&categorieLien=cid Order n° 2018-1125 of 12 December 2018]. <br />
<br />
====Age of consent====<br />
The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".<br />
<br />
====Freedom of Speech====<br />
The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés". <br />
<br />
====Employment context====<br />
Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks. <br />
<br />
====Research====<br />
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés". <br />
<br />
====Other relevant national provisions and laws====<br />
The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law. <br />
<br />
===National ePrivacy Law===<br />
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004]. <br />
==Data Protection Authority==<br />
<br />
===General information===<br />
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.<br />
<br />
→ Profile: [[CNIL (France)]]<br />
<br />
===Procedural information===<br />
<br />
====Applicable Procedural Law====<br />
The CNIL operates under the law "''Informatique et Libertés''" under the conditions laid down by Articles 19 to 29. See the law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 here], in French. The law "informatique et Libetés" has to be read jointly with the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29]. <br />
<br />
====Complaints Procedure under Art 77 GDPR====<br />
According to [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8, par.2 d)] of the loi "''Informatique et Liberté''", a data subject or their representative(s) can lodge a complaint with the CNIL regarding an alleged infringment of the GDPR. <br />
<br />
According to Article 10 of the Decree n°2019-536, the complaint will be deemed rejected if the CNIL did not reach the author of the complaint within a three months period, regarding its complaint - whatever the means-.<br />
<br />
====''Ex Officio'' Procedures under Art 57 GDPR====<br />
The CNIL can run ''ex officio'' procedures out of its own motion. Its powers are described under [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8] of the law "''Informatique et Libertés''".<br />
==Judicial protection==<br />
===Civil Courts===<br />
The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts. <br />
<br />
===Administrative Courts===<br />
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits"). <br />
<br />
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Coucil held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc.. <br />
<br />
<u>The criteriae can also be prescribed by law.</u> <br />
<br />
The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial intance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, other admissibility requirements can be found below: <br />
<br />
'''Regarding the decision''' : it can be the lack of response or the notification of the CNIL's decision to the data subject<br />
<br />
*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29]. <br />
<br />
*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6],<br />
*The motion has to be sent jointly with the decision at stake according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2],<br />
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted elecronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5]<br />
<br />
'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity<br />
<br />
In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists a serous doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code. <br />
<br />
You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].<br />
<br />
===Constitutional Council===<br />
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Data_Protection_in_France&diff=10476Data Protection in France2020-06-09T10:18:23Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |Data Protection in France<br />
[[Category:Country Overview]]<br />
|-<br />
| colspan="2" |[[File:fr.png|center|250px]]<br />
|-<br />
|Data Protection Authority:||[[CNIL (France)]]<br />
|-<br />
|National Implementation Law (Original):||[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006068624&dateTexte=20190212 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés]<br />
|-<br />
|English Translation of National Implementation Law:||[n/a English Translation]<br />
|-<br />
|Official Language(s):||French<br />
|-<br />
|National Legislation Database(s):||[https://www.legifrance.gouv.fr/ Légifrance]<br />
|-<br />
|English Legislation Database(s):||n/a<br />
|-<br />
|National Decision Database(s):||[https://www.legifrance.gouv.fr/ Link]<br />
|}<br />
<br />
==Legislation==<br />
===History===<br />
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés. <br />
<br />
===National constitutional protections===<br />
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996). <br />
<br />
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.<br />
<br />
===National GDPR implementation law===<br />
In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the L[https://www.legifrance.gouv.fr/eli/loi/2018/6/20/JUSC1732261L/jo/texte oi n° 2018-493 of 20 June 2018] , the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037277401&categorieLien=id Decree n° 2018-687 of 1st August 2018] which has been enacted to implement the aforementionned Law and lastly, the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000037800506&categorieLien=cid Order n° 2018-1125 of 12 December 2018]. <br />
<br />
====Age of consent====<br />
The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".<br />
<br />
====Freedom of Speech====<br />
The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés". <br />
<br />
====Employment context====<br />
Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks. <br />
<br />
====Research====<br />
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés". <br />
<br />
====Other relevant national provisions and laws====<br />
The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law. <br />
<br />
===National ePrivacy Law===<br />
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004]. <br />
==Data Protection Authority==<br />
<br />
===General information===<br />
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.<br />
<br />
→ Profile: [[CNIL (France)]]<br />
<br />
===Procedural information===<br />
<br />
====Applicable Procedural Law====<br />
The CNIL operates under the law "''Informatique et Libertés''" under the conditions laid down by Articles 19 to 29. See the law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 here], in French. <br />
<br />
====Complaints Procedure under Art 77 GDPR====<br />
The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial intance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice.<br />
<br />
Any CNIL's decision can be challenged within the four months following the notification of the decision, with the conditions and limits provided for in the Code of Administrative Justice. More precisely, the admissibility requirements are the followings:<br />
<br />
* the motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6], <br />
* the motion has to be sent jointly with the decision at stake according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2],<br />
* it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted elecronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5]<br />
* as <br />
* the complaint has to be send following the times 421-7 and R 432-1 to R 441-1 of the Code of Administrative Justice.<br />
<br />
You can find the provisions of the Code of Administrative Justice in French here.<br />
<br />
====''Ex Officio'' Procedures under Art 57 GDPR====<br />
The CNIL can run ''ex officio'' procedures out of its own motion. Its powers are described under [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8] of the law "''Informatique et Libertés''".<br />
==Judicial protection==<br />
===Civil Courts===<br />
The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts. <br />
<br />
===Administrative Courts===<br />
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits"). <br />
<br />
The criteria are mainly established by case-law. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Coucil held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc.. <br />
<br />
The criteriae can also be prescribed by law. For example and as explained above, CNIL's decisions are only challeangeable before the Conseil d'Etat as a first and last instance. <br />
<br />
===Constitutional Council===<br />
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CPDP_-01-433/2019&diff=10293CPDP -01-433/20192020-05-25T12:06:50Z<p>Juliette Leportois: Juliette Leportois moved page CPDP -01-433/2019 to CPDP - 01-433/2019</p>
<hr />
<div>#REDIRECT [[CPDP - 01-433/2019]]</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CPDP_(Bulgaria)_-_PNN-01-433/2019&diff=10292CPDP (Bulgaria) - PNN-01-433/20192020-05-25T12:06:50Z<p>Juliette Leportois: Juliette Leportois moved page CPDP -01-433/2019 to CPDP - 01-433/2019</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Bulgaria<br />
|DPA-BG-Color=background-color:#ffffff;<br />
|DPAlogo=LogoBG.jpg<br />
|DPA_Abbrevation=CPDP<br />
|DPA_With_Country=CPDP (Bulgaria)<br />
<br />
|Case_Number_Name=01-433/2019 <br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Bulgarian DPA Bulletin 3 (84), May 2020<br />
|Original_Source_Link_1=https://www.cpdp.bg/?p=element&aid=1247<br />
|Original_Source_Language_1=Bulgarian<br />
|Original_Source_Language__Code_1=BG<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=14.04.2020<br />
|Date_Published=<br />
|Year=2020<br />
|Fine=2000<br />
|Currency=BGN<br />
<br />
|GDPR_Article_1=Article 6(1)(a) GDPR<br />
|GDPR_Article_Link_1=Article 6 GDPR#1a<br />
<br />
<br />
<br />
|Party_Name_1=Mr. Y.L. <br />
|Party_Link_1=<br />
|Party_Name_2=A political party (the name is not specified)<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=Monika Dafinova<br />
|<br />
}}<br />
<br />
14 April 2020, the Bulgarian Commission for Personal Data Protection imposed a fine of BGN 2 000 (approximately EUR 1 000) on a political party (the name of the political party is not specified). The political party processed Mr. Y.L.’s personal data without any legal ground as required by Article 6, para. 1 GDPR. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Bulgarian DPA examined a complaint lodged by a citizen, Mr. Y.L., against a political party for unlawful processing of his personal data (names and personal number). <br />
The data were included in a list of supporters prepared by the political party. The list is a mandatory legal requirement for a person to be registered as a candidate in the elections for Bulgarian members of the European Parliament, conducted in Bulgaria on 26th May 2019. <br />
Mr. Y.L. claims that he has established the violation after he submitted an electronic inquiry before the Central Election Commission on 27th April 2019. He claims that he did not sign in any list in support of the registration of the person as a candidate in the elections and he did not give his consent to the processing of his personal data. Mr. Y.L. considers the presence of his personal data in the abovementioned list as a violation of his rights.<br />
The political party claims that the complainants’ personal data was lawfully processed on the ground of his explicit consent. Mr. Y.L. expressed his consent by signing in the list with supporters. In addition, the political party claims that Mr. Y.L. is not a member of the party and his personal data have not been previously processed. <br />
<br />
=== Dispute ===<br />
Is there a violation of Article 6, para. 1 GDPR committed by the political party? Have the data of Y.L. being lawfully processed? <br />
<br />
=== Holding ===<br />
The Bulgarian DPA decided that the complaint against the political party is founded and imposed a fine of BGN 2 000. <br />
The provision of personal data by a political party to the Central Election Commission for the purposes of a registration of a candidate in the elections for Bulgarian members of the European Parliament is a form of personal data processing and as such shall be lawfully performed in accordance with of Art. 6, para. 1 of the GDPR.<br />
For the purposes of clarification of the case from a legal and factual point of view, the Bulgarian DPA requested a handwriting expertise of the complainants’ signature to be conducted. <br />
After examining both signatures (the one on the list of supporters and the one given by Mr. Y.L.), the National Institute of Forensics concluded that the signature are not identical.<br />
Following that, the Bulgaria DPA concluded that the processing of complainants’ personal data is unlawful – there is no explicit consent as this is one of the legal grounds for lawful processing of personal data.<br />
<br />
== Comment ==<br />
Decision № -01-461/2019 г. has an equivalent reasoning but does not concern the same complainant. You can find this decision on the P.28 of the same report. <br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.<br />
<br />
<pre><br />
Decision No ппН-01-433 / 2019 Sofia, 14.04.2020<br />
The Commission for Personal Data Protection (CPDP) composed of: Chairman: Ventsislav Karadzhov and members: Tsanko Tsolov and Veselin Tselkov at a meeting held on January 29, 2020, pursuant to Art. 10, para. 1 of the Personal Data Protection Act, respectively Art. 57, § 1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Regulation ), considered on the merits complaint No. PPN-01-433 / 03.05.2019 filed by J.L.<br />
The administrative proceedings are by the order of art. 38 of the Personal Data Protection Act (PDPA).<br />
The Commission for Personal Data Protection was seised with a complaint filed by J.L. against a political party (PP), with allegations of illegal processing of his personal data by including them in a list of persons supporting the registration of the political entity to participate in the elections for members of the European Parliament from the Republic of Bulgaria, held on 26.05.2019 г.<br />
The complainant claims that he has established the violation after an electronic inquiry made on 27 April 2019 at the Central Election Commission, a certified copy of which he encloses. He stated that he had not signed in support of the registration of the political entity and had not given his consent to the processing of his personal data for the specific purpose. Considers the presence of his personal data in these lists as a violation of his rights under the LPPD.<br />
P.P. was informed about the initiated administrative proceedings and about the possibility to engage a written statement on the case.<br />
In response, an opinion was expressed that the complaint was unfounded with allegations of legality of the processing of personal data by P.P. in the presence of an explicit consent and desire expressed by the complainant for his entry in the lists under Art. 133, para. 3, item 5 of the Electoral Code (EC) for the specific elections. In addition, it is stated that there is no data Mr. J.L. to have been a member of P.P. and his personal data to have been previously processed by the political entity.<br />
In order to clarify the case from a legal and factual point of view and in the conditions of the official beginning of the administrative process, the Central Election Commission requested relevant evidence, in response to which a certified copy submitted by P.P. application for registration for participation in the specific elections and a certified copy on page *** of the List of voters supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. It is evident from the presented evidence that on page ***, line **** of the list there are personal data of the complainant in a volume of three names. and a single civil number, as well as a signature.<br />
The Commission for Personal Data Protection is an independent state body that protects individuals in the processing of personal data and in accessing such data, as well as monitoring compliance with the LPPD and Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.<br />
In order to exercise its powers, the Commission should be properly seised.<br />
The appeal shall contain the obligatorily required requisites, specified in the provision of art. 28, para. 1 of the Rules of Procedure of the Commission for Personal Data Protection and its administration (PDKZLDNA), namely: there are data about the complainant, the nature of the request, date and signature, in view of which it is regular.<br />
The appeal is procedurally admissible, filed within the term under Art. 38, para. 1 of LPPD by a natural person with a legal interest against a competent party, a legal entity - personal data administrator within the meaning of Art. 4, § 7 of EU Regulation 2016/679 and the Electoral Code. The subject of the complaint are the allegations of illegal processing of personal data of the complainant - names and a single civil number by P.P. by including them in the List provided to the CEC of the persons supporting the registration of the political entity for participation in the elections for members of the European Parliament from the Republic of Bulgaria, held on May 26, 2019.<br />
The appeal was referred to a competent body to rule - the CPDP, which according to its powers under Art. 10, para. 1 of LPPD in connection with Art. 57, § 1, letter "f" of Regulation (EU) 2016/679, deals with complaints against acts and actions of personal data controllers which violate the rights of data subjects related to the processing of personal data, as they do not exist the exceptions under Art. 2, § 2, letter “c” and Art. 55, § 3 of Regulation (EU) 2016/679 given the fact that the case does not concern processing activities performed by a natural person in the course of purely personal or domestic activities and / or activities performed by the courts in the performance of their judicial functions.<br />
For the stated reasons and given the lack of negative prerequisites specified in Art. 27, para. 2 of the APC, at a meeting of the CPDP held on 09.10.2019, the appeal was accepted as procedurally admissible and as parties to the proceedings were constituted: complainant J.L. and the respondent - P.P.<br />
In order to clarify the case from a legal and factual point of view, it is allowed to perform handwriting expertise of the signature placed on page ***, line **** of the list of voters submitted to the CEC, supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. For the purposes of the latter the applicant provided comparative material, which was sent to the National Institute of Forensics (NIC).<br />
A graphic expertise was prepared, reflected in Protocol No. 19 / DOK-270 of 18.11.2019, according to the inventory of NIC, sent to the CPDP with an accompanying letter PPN-01-433 # 9 / 20.11.2019, with the conclusion that the signature object of the expertise was not laid by the applicant J.L.<br />
With a decision from a meeting of the CPDP held on 04.12.2019, the appeal is scheduled for consideration on the merits on 29.01.2020, of which the parties have been regularly notified. The parties were provided with a copy of the expertise prepared in the case and were given the opportunity to express an opinion on it, to point out new evidence, to make requests on the evidence, but no such evidence was filed.<br />
At a meeting of the Commission held on 29 January 2020, the complaint was examined on the merits.<br />
The parties are regularly notified - they do not appear, they do not represent themselves.<br />
As an administrative body and in connection with the need to establish the truth of the case, as a basic principle in the administrative proceedings, according to Art. 7 of the APC, requiring the existence of established actual facts and given the evidence gathered and the allegations, the commission accepts that considered on the merits complaint No. PPN-01-433 / 03.05.2019 is justified.<br />
There is no dispute between the parties on the facts. It is notorious that on 26.05.2019 elections were held for members of the European Parliament from the Republic of Bulgaria, for participation in which, with Decision No. 136-EP of 10.04.2019 of the CEC, PP was also registered, on the basis of an application submitted. The application is accompanied by a list containing the three names, the unique civil number and the handwritten signature of 4,030 voters supporting the party's registration to run in the specific elections.<br />
It is not disputable, and it is evident from the materials submitted by the CEC, that the personal data of the complainant JL, in a volume of three names and a single civil number, are present on page ***, line **** from the list of voters. supporting the registration of P.P. for participation in the procedural elections.<br />
The provision of personal data by a political entity to the CEC for registration of the party for participation in the elections is a form of personal data processing and as such should be carried out in compliance with the provisions of EU Regulation 2016/679, in particular those of Art. 6, § 1 of the Regulation, the same applicable insofar as data were provided on 10.04.2019.<br />
The allegations of the complainant for illegal processing of his personal data by P.P. for the registration of the political entity in the elections held on 26.05.2019 are justified. In support of this conclusion is the conclusion of a graphic expertise reflected in Protocol No. 19 / DOK-270 of 18.11.2019, sent to the CPDP with a cover letter PPN-01-433 # 9 / 20.11.2019, that the signature on page ***, line **** - the object of the expertise was not laid by the complainant J.L. The above testifies that the processing of the personal data of Mr. J.L. for the specific purpose was made without his consent - a specific and informed statement of intent within the meaning of Art. 4, § 11 of the Regulation. Evidence to the contrary is not involved.<br />
In the specific case, none of the other hypotheses mentioned in Art. 6, § 1 of the Regulation, insofar as it cannot be substantiated, and there is no evidence in the file, the processing must have been carried out in fulfillment of a statutory obligation of the personal data controller or for exercising powers granted to the controller by law. for the protection of the life and health of the natural person to whom the data relate or to perform a task in the public interest or to perform obligations under a contract to which the complainant is a party. Given the lack of consent of the person to process his personal data for the specific purpose, it follows that the hypothesis of Art. 6, § 1, letter "e" of the Regulation insofar as the processing of personal data for the realization of the interests of the administrator for participation in the elections is not a priority over the interest of the affected natural person.<br />
It is necessary to conclude that the personal data of the complainant have been processed - provided by P.P. of the CEC for the registration of the political entity for participation in elections on 26.05.2019 in violation of Art. 6, § 1 of the Regulation, without any of the conditions for admissibility of the processing specified in the provision and are a violation of the rights of the person who has referred to the CPDP.<br />
In view of the nature of the established violation, the commission considers that the corrective measures under Art. 58, § 2 (a), (b), (c), (d), (e), "f", "g", "h" and "j" of the Regulation are inapplicable and inappropriate in this case, given the gravity of the infringement and the fact that it has been completed and is irreversible. In the present case, the pecuniary sanction provided for in Article 58 (2) (i) of the Regulation is the most appropriate, effective, dissuasive and proportionate for the protection of the legitimate public interest. It should be noted that in addition to a purely sanction measure, a reaction of the state to the violation of the statutory rules, the property sanction also has a disciplinary effect, in view of the non-commission of the same violation in the future. The administrator is obliged to know the law and to observe its requirements, moreover, that he owes the necessary care provided by law and arising from his subject of activity, human and economic resources.<br />
In determining the amount of the sanction and in accordance with the conditions under Art. 83, § 2 of the Regulation, the commission took into account that it was a violation of the rights of a natural person. As aggravating circumstances were reported that the violation is irreparable, and the same has become known to the CPDP as a result of its referral by the victim. The commission also considers as an aggravating circumstance the fact that data on a person's unique civil number have been processed, as well as that it concerns the processing of personal data in order to create political affiliation with views and policies expressed by the political entity, as well as restriction of rights related to electoral legislation. In choosing the corrective power, and in determining the amount of the sanction, the commission also took into account that the violation is not the first, but consecutively for the administrator who is sanctioned for an identical violation by Decision No. G-792/2016 of the CPDP, and his behavior in processing personal data in the election process was sanctioned by Decision R-755 / 02.09.2015 of the Commission, which entered into force. The circumstances under Art. 83, § 2, letters “b” and “i” of the Regulation are irrelevant as far as the administrator is concerned - a legal entity that does not form a fault, and at the time of the violation approved codes of conduct, respectively approved certification mechanisms are not introduced.<br />
The Commission considers that, in view of the principle of proportionality between the gravity of the infringement and the amount of the penalty imposed on P.P. a pecuniary sanction should amount to BGN 2,000 - an amount well below the average minimum provided for in the Regulation for this violation. Taking into account the purpose of the penalty, which should have a deterrent and warning function, the nature and severity of the violation, the public relations it affects, the categories of personal data concerned, the Commission considers that the powers exercised in type and amount indisputably 679 efficiency and deterrent effect, while not violating the principle of proportionality and the requirement of proportionality.<br />
Guided by the above and on the grounds of Art. 38, para. 3 of LPPD, the Commission for Personal Data Protection, HAS DECIDED AS FOLLOWS:<br />
1. Announces complaint No. ppN-01-433 / 03.05.2019, filed by J.L. against political<br />
party, for justified.<br />
2. On the grounds of art. 83, § 5, letter “a”, in connection with Art. 58, § 2, letter “i” of Regulation (EU) 2016/679 imposes on a political party with Bulstat ********** an administrative penalty - a property sanction in the amount of BGN 2,000 (two thousand levs) for processing the personal data of the complainant in violation of Art. 6, § 1 of the Regulation.<br />
The decision is subject to appeal within 14 days of its service, through the Commission for Personal Data Protection, before the Administrative Court of Sofia - city.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CPDP_-_DSB-01-433/2019&diff=10291CPDP - DSB-01-433/20192020-05-25T12:06:42Z<p>Juliette Leportois: Juliette Leportois moved page CPDP - DSB-01-433/2019 to CPDP -01-433/2019</p>
<hr />
<div>#REDIRECT [[CPDP -01-433/2019]]</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CPDP_(Bulgaria)_-_PNN-01-433/2019&diff=10290CPDP (Bulgaria) - PNN-01-433/20192020-05-25T12:06:42Z<p>Juliette Leportois: Juliette Leportois moved page CPDP - DSB-01-433/2019 to CPDP -01-433/2019</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Bulgaria<br />
|DPA-BG-Color=background-color:#ffffff;<br />
|DPAlogo=LogoBG.jpg<br />
|DPA_Abbrevation=CPDP<br />
|DPA_With_Country=CPDP (Bulgaria)<br />
<br />
|Case_Number_Name=01-433/2019 <br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Bulgarian DPA Bulletin 3 (84), May 2020<br />
|Original_Source_Link_1=https://www.cpdp.bg/?p=element&aid=1247<br />
|Original_Source_Language_1=Bulgarian<br />
|Original_Source_Language__Code_1=BG<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=14.04.2020<br />
|Date_Published=<br />
|Year=2020<br />
|Fine=2000<br />
|Currency=BGN<br />
<br />
|GDPR_Article_1=Article 6(1)(a) GDPR<br />
|GDPR_Article_Link_1=Article 6 GDPR#1a<br />
<br />
<br />
<br />
|Party_Name_1=Mr. Y.L. <br />
|Party_Link_1=<br />
|Party_Name_2=A political party (the name is not specified)<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=Monika Dafinova<br />
|<br />
}}<br />
<br />
14 April 2020, the Bulgarian Commission for Personal Data Protection imposed a fine of BGN 2 000 (approximately EUR 1 000) on a political party (the name of the political party is not specified). The political party processed Mr. Y.L.’s personal data without any legal ground as required by Article 6, para. 1 GDPR. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Bulgarian DPA examined a complaint lodged by a citizen, Mr. Y.L., against a political party for unlawful processing of his personal data (names and personal number). <br />
The data were included in a list of supporters prepared by the political party. The list is a mandatory legal requirement for a person to be registered as a candidate in the elections for Bulgarian members of the European Parliament, conducted in Bulgaria on 26th May 2019. <br />
Mr. Y.L. claims that he has established the violation after he submitted an electronic inquiry before the Central Election Commission on 27th April 2019. He claims that he did not sign in any list in support of the registration of the person as a candidate in the elections and he did not give his consent to the processing of his personal data. Mr. Y.L. considers the presence of his personal data in the abovementioned list as a violation of his rights.<br />
The political party claims that the complainants’ personal data was lawfully processed on the ground of his explicit consent. Mr. Y.L. expressed his consent by signing in the list with supporters. In addition, the political party claims that Mr. Y.L. is not a member of the party and his personal data have not been previously processed. <br />
<br />
=== Dispute ===<br />
Is there a violation of Article 6, para. 1 GDPR committed by the political party? Have the data of Y.L. being lawfully processed? <br />
<br />
=== Holding ===<br />
The Bulgarian DPA decided that the complaint against the political party is founded and imposed a fine of BGN 2 000. <br />
The provision of personal data by a political party to the Central Election Commission for the purposes of a registration of a candidate in the elections for Bulgarian members of the European Parliament is a form of personal data processing and as such shall be lawfully performed in accordance with of Art. 6, para. 1 of the GDPR.<br />
For the purposes of clarification of the case from a legal and factual point of view, the Bulgarian DPA requested a handwriting expertise of the complainants’ signature to be conducted. <br />
After examining both signatures (the one on the list of supporters and the one given by Mr. Y.L.), the National Institute of Forensics concluded that the signature are not identical.<br />
Following that, the Bulgaria DPA concluded that the processing of complainants’ personal data is unlawful – there is no explicit consent as this is one of the legal grounds for lawful processing of personal data.<br />
<br />
== Comment ==<br />
Decision № -01-461/2019 г. has an equivalent reasoning but does not concern the same complainant. You can find this decision on the P.28 of the same report. <br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.<br />
<br />
<pre><br />
Decision No ппН-01-433 / 2019 Sofia, 14.04.2020<br />
The Commission for Personal Data Protection (CPDP) composed of: Chairman: Ventsislav Karadzhov and members: Tsanko Tsolov and Veselin Tselkov at a meeting held on January 29, 2020, pursuant to Art. 10, para. 1 of the Personal Data Protection Act, respectively Art. 57, § 1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Regulation ), considered on the merits complaint No. PPN-01-433 / 03.05.2019 filed by J.L.<br />
The administrative proceedings are by the order of art. 38 of the Personal Data Protection Act (PDPA).<br />
The Commission for Personal Data Protection was seised with a complaint filed by J.L. against a political party (PP), with allegations of illegal processing of his personal data by including them in a list of persons supporting the registration of the political entity to participate in the elections for members of the European Parliament from the Republic of Bulgaria, held on 26.05.2019 г.<br />
The complainant claims that he has established the violation after an electronic inquiry made on 27 April 2019 at the Central Election Commission, a certified copy of which he encloses. He stated that he had not signed in support of the registration of the political entity and had not given his consent to the processing of his personal data for the specific purpose. Considers the presence of his personal data in these lists as a violation of his rights under the LPPD.<br />
P.P. was informed about the initiated administrative proceedings and about the possibility to engage a written statement on the case.<br />
In response, an opinion was expressed that the complaint was unfounded with allegations of legality of the processing of personal data by P.P. in the presence of an explicit consent and desire expressed by the complainant for his entry in the lists under Art. 133, para. 3, item 5 of the Electoral Code (EC) for the specific elections. In addition, it is stated that there is no data Mr. J.L. to have been a member of P.P. and his personal data to have been previously processed by the political entity.<br />
In order to clarify the case from a legal and factual point of view and in the conditions of the official beginning of the administrative process, the Central Election Commission requested relevant evidence, in response to which a certified copy submitted by P.P. application for registration for participation in the specific elections and a certified copy on page *** of the List of voters supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. It is evident from the presented evidence that on page ***, line **** of the list there are personal data of the complainant in a volume of three names. and a single civil number, as well as a signature.<br />
The Commission for Personal Data Protection is an independent state body that protects individuals in the processing of personal data and in accessing such data, as well as monitoring compliance with the LPPD and Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.<br />
In order to exercise its powers, the Commission should be properly seised.<br />
The appeal shall contain the obligatorily required requisites, specified in the provision of art. 28, para. 1 of the Rules of Procedure of the Commission for Personal Data Protection and its administration (PDKZLDNA), namely: there are data about the complainant, the nature of the request, date and signature, in view of which it is regular.<br />
The appeal is procedurally admissible, filed within the term under Art. 38, para. 1 of LPPD by a natural person with a legal interest against a competent party, a legal entity - personal data administrator within the meaning of Art. 4, § 7 of EU Regulation 2016/679 and the Electoral Code. The subject of the complaint are the allegations of illegal processing of personal data of the complainant - names and a single civil number by P.P. by including them in the List provided to the CEC of the persons supporting the registration of the political entity for participation in the elections for members of the European Parliament from the Republic of Bulgaria, held on May 26, 2019.<br />
The appeal was referred to a competent body to rule - the CPDP, which according to its powers under Art. 10, para. 1 of LPPD in connection with Art. 57, § 1, letter "f" of Regulation (EU) 2016/679, deals with complaints against acts and actions of personal data controllers which violate the rights of data subjects related to the processing of personal data, as they do not exist the exceptions under Art. 2, § 2, letter “c” and Art. 55, § 3 of Regulation (EU) 2016/679 given the fact that the case does not concern processing activities performed by a natural person in the course of purely personal or domestic activities and / or activities performed by the courts in the performance of their judicial functions.<br />
For the stated reasons and given the lack of negative prerequisites specified in Art. 27, para. 2 of the APC, at a meeting of the CPDP held on 09.10.2019, the appeal was accepted as procedurally admissible and as parties to the proceedings were constituted: complainant J.L. and the respondent - P.P.<br />
In order to clarify the case from a legal and factual point of view, it is allowed to perform handwriting expertise of the signature placed on page ***, line **** of the list of voters submitted to the CEC, supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. For the purposes of the latter the applicant provided comparative material, which was sent to the National Institute of Forensics (NIC).<br />
A graphic expertise was prepared, reflected in Protocol No. 19 / DOK-270 of 18.11.2019, according to the inventory of NIC, sent to the CPDP with an accompanying letter PPN-01-433 # 9 / 20.11.2019, with the conclusion that the signature object of the expertise was not laid by the applicant J.L.<br />
With a decision from a meeting of the CPDP held on 04.12.2019, the appeal is scheduled for consideration on the merits on 29.01.2020, of which the parties have been regularly notified. The parties were provided with a copy of the expertise prepared in the case and were given the opportunity to express an opinion on it, to point out new evidence, to make requests on the evidence, but no such evidence was filed.<br />
At a meeting of the Commission held on 29 January 2020, the complaint was examined on the merits.<br />
The parties are regularly notified - they do not appear, they do not represent themselves.<br />
As an administrative body and in connection with the need to establish the truth of the case, as a basic principle in the administrative proceedings, according to Art. 7 of the APC, requiring the existence of established actual facts and given the evidence gathered and the allegations, the commission accepts that considered on the merits complaint No. PPN-01-433 / 03.05.2019 is justified.<br />
There is no dispute between the parties on the facts. It is notorious that on 26.05.2019 elections were held for members of the European Parliament from the Republic of Bulgaria, for participation in which, with Decision No. 136-EP of 10.04.2019 of the CEC, PP was also registered, on the basis of an application submitted. The application is accompanied by a list containing the three names, the unique civil number and the handwritten signature of 4,030 voters supporting the party's registration to run in the specific elections.<br />
It is not disputable, and it is evident from the materials submitted by the CEC, that the personal data of the complainant JL, in a volume of three names and a single civil number, are present on page ***, line **** from the list of voters. supporting the registration of P.P. for participation in the procedural elections.<br />
The provision of personal data by a political entity to the CEC for registration of the party for participation in the elections is a form of personal data processing and as such should be carried out in compliance with the provisions of EU Regulation 2016/679, in particular those of Art. 6, § 1 of the Regulation, the same applicable insofar as data were provided on 10.04.2019.<br />
The allegations of the complainant for illegal processing of his personal data by P.P. for the registration of the political entity in the elections held on 26.05.2019 are justified. In support of this conclusion is the conclusion of a graphic expertise reflected in Protocol No. 19 / DOK-270 of 18.11.2019, sent to the CPDP with a cover letter PPN-01-433 # 9 / 20.11.2019, that the signature on page ***, line **** - the object of the expertise was not laid by the complainant J.L. The above testifies that the processing of the personal data of Mr. J.L. for the specific purpose was made without his consent - a specific and informed statement of intent within the meaning of Art. 4, § 11 of the Regulation. Evidence to the contrary is not involved.<br />
In the specific case, none of the other hypotheses mentioned in Art. 6, § 1 of the Regulation, insofar as it cannot be substantiated, and there is no evidence in the file, the processing must have been carried out in fulfillment of a statutory obligation of the personal data controller or for exercising powers granted to the controller by law. for the protection of the life and health of the natural person to whom the data relate or to perform a task in the public interest or to perform obligations under a contract to which the complainant is a party. Given the lack of consent of the person to process his personal data for the specific purpose, it follows that the hypothesis of Art. 6, § 1, letter "e" of the Regulation insofar as the processing of personal data for the realization of the interests of the administrator for participation in the elections is not a priority over the interest of the affected natural person.<br />
It is necessary to conclude that the personal data of the complainant have been processed - provided by P.P. of the CEC for the registration of the political entity for participation in elections on 26.05.2019 in violation of Art. 6, § 1 of the Regulation, without any of the conditions for admissibility of the processing specified in the provision and are a violation of the rights of the person who has referred to the CPDP.<br />
In view of the nature of the established violation, the commission considers that the corrective measures under Art. 58, § 2 (a), (b), (c), (d), (e), "f", "g", "h" and "j" of the Regulation are inapplicable and inappropriate in this case, given the gravity of the infringement and the fact that it has been completed and is irreversible. In the present case, the pecuniary sanction provided for in Article 58 (2) (i) of the Regulation is the most appropriate, effective, dissuasive and proportionate for the protection of the legitimate public interest. It should be noted that in addition to a purely sanction measure, a reaction of the state to the violation of the statutory rules, the property sanction also has a disciplinary effect, in view of the non-commission of the same violation in the future. The administrator is obliged to know the law and to observe its requirements, moreover, that he owes the necessary care provided by law and arising from his subject of activity, human and economic resources.<br />
In determining the amount of the sanction and in accordance with the conditions under Art. 83, § 2 of the Regulation, the commission took into account that it was a violation of the rights of a natural person. As aggravating circumstances were reported that the violation is irreparable, and the same has become known to the CPDP as a result of its referral by the victim. The commission also considers as an aggravating circumstance the fact that data on a person's unique civil number have been processed, as well as that it concerns the processing of personal data in order to create political affiliation with views and policies expressed by the political entity, as well as restriction of rights related to electoral legislation. In choosing the corrective power, and in determining the amount of the sanction, the commission also took into account that the violation is not the first, but consecutively for the administrator who is sanctioned for an identical violation by Decision No. G-792/2016 of the CPDP, and his behavior in processing personal data in the election process was sanctioned by Decision R-755 / 02.09.2015 of the Commission, which entered into force. The circumstances under Art. 83, § 2, letters “b” and “i” of the Regulation are irrelevant as far as the administrator is concerned - a legal entity that does not form a fault, and at the time of the violation approved codes of conduct, respectively approved certification mechanisms are not introduced.<br />
The Commission considers that, in view of the principle of proportionality between the gravity of the infringement and the amount of the penalty imposed on P.P. a pecuniary sanction should amount to BGN 2,000 - an amount well below the average minimum provided for in the Regulation for this violation. Taking into account the purpose of the penalty, which should have a deterrent and warning function, the nature and severity of the violation, the public relations it affects, the categories of personal data concerned, the Commission considers that the powers exercised in type and amount indisputably 679 efficiency and deterrent effect, while not violating the principle of proportionality and the requirement of proportionality.<br />
Guided by the above and on the grounds of Art. 38, para. 3 of LPPD, the Commission for Personal Data Protection, HAS DECIDED AS FOLLOWS:<br />
1. Announces complaint No. ppN-01-433 / 03.05.2019, filed by J.L. against political<br />
party, for justified.<br />
2. On the grounds of art. 83, § 5, letter “a”, in connection with Art. 58, § 2, letter “i” of Regulation (EU) 2016/679 imposes on a political party with Bulstat ********** an administrative penalty - a property sanction in the amount of BGN 2,000 (two thousand levs) for processing the personal data of the complainant in violation of Art. 6, § 1 of the Regulation.<br />
The decision is subject to appeal within 14 days of its service, through the Commission for Personal Data Protection, before the Administrative Court of Sofia - city.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CPDP_(Bulgaria)_-_PNN-01-433/2019&diff=10289CPDP (Bulgaria) - PNN-01-433/20192020-05-25T11:58:24Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Bulgaria<br />
|DPA-BG-Color=background-color:#ffffff;<br />
|DPAlogo=LogoBG.jpg<br />
|DPA_Abbrevation=CPDP<br />
|DPA_With_Country=CPDP (Bulgaria)<br />
<br />
|Case_Number_Name=01-433/2019 <br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Bulgarian DPA Bulletin 3 (84), May 2020<br />
|Original_Source_Link_1=https://www.cpdp.bg/?p=element&aid=1247<br />
|Original_Source_Language_1=Bulgarian<br />
|Original_Source_Language__Code_1=BG<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=14.04.2020<br />
|Date_Published=<br />
|Year=2020<br />
|Fine=2000<br />
|Currency=BGN<br />
<br />
|GDPR_Article_1=Article 6(1)(a) GDPR<br />
|GDPR_Article_Link_1=Article 6 GDPR#1a<br />
<br />
<br />
<br />
|Party_Name_1=Mr. Y.L. <br />
|Party_Link_1=<br />
|Party_Name_2=A political party (the name is not specified)<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=Monika Dafinova<br />
|<br />
}}<br />
<br />
14 April 2020, the Bulgarian Commission for Personal Data Protection imposed a fine of BGN 2 000 (approximately EUR 1 000) on a political party (the name of the political party is not specified). The political party processed Mr. Y.L.’s personal data without any legal ground as required by Article 6, para. 1 GDPR. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Bulgarian DPA examined a complaint lodged by a citizen, Mr. Y.L., against a political party for unlawful processing of his personal data (names and personal number). <br />
The data were included in a list of supporters prepared by the political party. The list is a mandatory legal requirement for a person to be registered as a candidate in the elections for Bulgarian members of the European Parliament, conducted in Bulgaria on 26th May 2019. <br />
Mr. Y.L. claims that he has established the violation after he submitted an electronic inquiry before the Central Election Commission on 27th April 2019. He claims that he did not sign in any list in support of the registration of the person as a candidate in the elections and he did not give his consent to the processing of his personal data. Mr. Y.L. considers the presence of his personal data in the abovementioned list as a violation of his rights.<br />
The political party claims that the complainants’ personal data was lawfully processed on the ground of his explicit consent. Mr. Y.L. expressed his consent by signing in the list with supporters. In addition, the political party claims that Mr. Y.L. is not a member of the party and his personal data have not been previously processed. <br />
<br />
=== Dispute ===<br />
Is there a violation of Article 6, para. 1 GDPR committed by the political party? Have the data of Y.L. being lawfully processed? <br />
<br />
=== Holding ===<br />
The Bulgarian DPA decided that the complaint against the political party is founded and imposed a fine of BGN 2 000. <br />
The provision of personal data by a political party to the Central Election Commission for the purposes of a registration of a candidate in the elections for Bulgarian members of the European Parliament is a form of personal data processing and as such shall be lawfully performed in accordance with of Art. 6, para. 1 of the GDPR.<br />
For the purposes of clarification of the case from a legal and factual point of view, the Bulgarian DPA requested a handwriting expertise of the complainants’ signature to be conducted. <br />
After examining both signatures (the one on the list of supporters and the one given by Mr. Y.L.), the National Institute of Forensics concluded that the signature are not identical.<br />
Following that, the Bulgaria DPA concluded that the processing of complainants’ personal data is unlawful – there is no explicit consent as this is one of the legal grounds for lawful processing of personal data.<br />
<br />
== Comment ==<br />
Decision № -01-461/2019 г. has an equivalent reasoning but does not concern the same complainant. You can find this decision on the P.28 of the same report. <br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.<br />
<br />
<pre><br />
Decision No ппН-01-433 / 2019 Sofia, 14.04.2020<br />
The Commission for Personal Data Protection (CPDP) composed of: Chairman: Ventsislav Karadzhov and members: Tsanko Tsolov and Veselin Tselkov at a meeting held on January 29, 2020, pursuant to Art. 10, para. 1 of the Personal Data Protection Act, respectively Art. 57, § 1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Regulation ), considered on the merits complaint No. PPN-01-433 / 03.05.2019 filed by J.L.<br />
The administrative proceedings are by the order of art. 38 of the Personal Data Protection Act (PDPA).<br />
The Commission for Personal Data Protection was seised with a complaint filed by J.L. against a political party (PP), with allegations of illegal processing of his personal data by including them in a list of persons supporting the registration of the political entity to participate in the elections for members of the European Parliament from the Republic of Bulgaria, held on 26.05.2019 г.<br />
The complainant claims that he has established the violation after an electronic inquiry made on 27 April 2019 at the Central Election Commission, a certified copy of which he encloses. He stated that he had not signed in support of the registration of the political entity and had not given his consent to the processing of his personal data for the specific purpose. Considers the presence of his personal data in these lists as a violation of his rights under the LPPD.<br />
P.P. was informed about the initiated administrative proceedings and about the possibility to engage a written statement on the case.<br />
In response, an opinion was expressed that the complaint was unfounded with allegations of legality of the processing of personal data by P.P. in the presence of an explicit consent and desire expressed by the complainant for his entry in the lists under Art. 133, para. 3, item 5 of the Electoral Code (EC) for the specific elections. In addition, it is stated that there is no data Mr. J.L. to have been a member of P.P. and his personal data to have been previously processed by the political entity.<br />
In order to clarify the case from a legal and factual point of view and in the conditions of the official beginning of the administrative process, the Central Election Commission requested relevant evidence, in response to which a certified copy submitted by P.P. application for registration for participation in the specific elections and a certified copy on page *** of the List of voters supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. It is evident from the presented evidence that on page ***, line **** of the list there are personal data of the complainant in a volume of three names. and a single civil number, as well as a signature.<br />
The Commission for Personal Data Protection is an independent state body that protects individuals in the processing of personal data and in accessing such data, as well as monitoring compliance with the LPPD and Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.<br />
In order to exercise its powers, the Commission should be properly seised.<br />
The appeal shall contain the obligatorily required requisites, specified in the provision of art. 28, para. 1 of the Rules of Procedure of the Commission for Personal Data Protection and its administration (PDKZLDNA), namely: there are data about the complainant, the nature of the request, date and signature, in view of which it is regular.<br />
The appeal is procedurally admissible, filed within the term under Art. 38, para. 1 of LPPD by a natural person with a legal interest against a competent party, a legal entity - personal data administrator within the meaning of Art. 4, § 7 of EU Regulation 2016/679 and the Electoral Code. The subject of the complaint are the allegations of illegal processing of personal data of the complainant - names and a single civil number by P.P. by including them in the List provided to the CEC of the persons supporting the registration of the political entity for participation in the elections for members of the European Parliament from the Republic of Bulgaria, held on May 26, 2019.<br />
The appeal was referred to a competent body to rule - the CPDP, which according to its powers under Art. 10, para. 1 of LPPD in connection with Art. 57, § 1, letter "f" of Regulation (EU) 2016/679, deals with complaints against acts and actions of personal data controllers which violate the rights of data subjects related to the processing of personal data, as they do not exist the exceptions under Art. 2, § 2, letter “c” and Art. 55, § 3 of Regulation (EU) 2016/679 given the fact that the case does not concern processing activities performed by a natural person in the course of purely personal or domestic activities and / or activities performed by the courts in the performance of their judicial functions.<br />
For the stated reasons and given the lack of negative prerequisites specified in Art. 27, para. 2 of the APC, at a meeting of the CPDP held on 09.10.2019, the appeal was accepted as procedurally admissible and as parties to the proceedings were constituted: complainant J.L. and the respondent - P.P.<br />
In order to clarify the case from a legal and factual point of view, it is allowed to perform handwriting expertise of the signature placed on page ***, line **** of the list of voters submitted to the CEC, supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. For the purposes of the latter the applicant provided comparative material, which was sent to the National Institute of Forensics (NIC).<br />
A graphic expertise was prepared, reflected in Protocol No. 19 / DOK-270 of 18.11.2019, according to the inventory of NIC, sent to the CPDP with an accompanying letter PPN-01-433 # 9 / 20.11.2019, with the conclusion that the signature object of the expertise was not laid by the applicant J.L.<br />
With a decision from a meeting of the CPDP held on 04.12.2019, the appeal is scheduled for consideration on the merits on 29.01.2020, of which the parties have been regularly notified. The parties were provided with a copy of the expertise prepared in the case and were given the opportunity to express an opinion on it, to point out new evidence, to make requests on the evidence, but no such evidence was filed.<br />
At a meeting of the Commission held on 29 January 2020, the complaint was examined on the merits.<br />
The parties are regularly notified - they do not appear, they do not represent themselves.<br />
As an administrative body and in connection with the need to establish the truth of the case, as a basic principle in the administrative proceedings, according to Art. 7 of the APC, requiring the existence of established actual facts and given the evidence gathered and the allegations, the commission accepts that considered on the merits complaint No. PPN-01-433 / 03.05.2019 is justified.<br />
There is no dispute between the parties on the facts. It is notorious that on 26.05.2019 elections were held for members of the European Parliament from the Republic of Bulgaria, for participation in which, with Decision No. 136-EP of 10.04.2019 of the CEC, PP was also registered, on the basis of an application submitted. The application is accompanied by a list containing the three names, the unique civil number and the handwritten signature of 4,030 voters supporting the party's registration to run in the specific elections.<br />
It is not disputable, and it is evident from the materials submitted by the CEC, that the personal data of the complainant JL, in a volume of three names and a single civil number, are present on page ***, line **** from the list of voters. supporting the registration of P.P. for participation in the procedural elections.<br />
The provision of personal data by a political entity to the CEC for registration of the party for participation in the elections is a form of personal data processing and as such should be carried out in compliance with the provisions of EU Regulation 2016/679, in particular those of Art. 6, § 1 of the Regulation, the same applicable insofar as data were provided on 10.04.2019.<br />
The allegations of the complainant for illegal processing of his personal data by P.P. for the registration of the political entity in the elections held on 26.05.2019 are justified. In support of this conclusion is the conclusion of a graphic expertise reflected in Protocol No. 19 / DOK-270 of 18.11.2019, sent to the CPDP with a cover letter PPN-01-433 # 9 / 20.11.2019, that the signature on page ***, line **** - the object of the expertise was not laid by the complainant J.L. The above testifies that the processing of the personal data of Mr. J.L. for the specific purpose was made without his consent - a specific and informed statement of intent within the meaning of Art. 4, § 11 of the Regulation. Evidence to the contrary is not involved.<br />
In the specific case, none of the other hypotheses mentioned in Art. 6, § 1 of the Regulation, insofar as it cannot be substantiated, and there is no evidence in the file, the processing must have been carried out in fulfillment of a statutory obligation of the personal data controller or for exercising powers granted to the controller by law. for the protection of the life and health of the natural person to whom the data relate or to perform a task in the public interest or to perform obligations under a contract to which the complainant is a party. Given the lack of consent of the person to process his personal data for the specific purpose, it follows that the hypothesis of Art. 6, § 1, letter "e" of the Regulation insofar as the processing of personal data for the realization of the interests of the administrator for participation in the elections is not a priority over the interest of the affected natural person.<br />
It is necessary to conclude that the personal data of the complainant have been processed - provided by P.P. of the CEC for the registration of the political entity for participation in elections on 26.05.2019 in violation of Art. 6, § 1 of the Regulation, without any of the conditions for admissibility of the processing specified in the provision and are a violation of the rights of the person who has referred to the CPDP.<br />
In view of the nature of the established violation, the commission considers that the corrective measures under Art. 58, § 2 (a), (b), (c), (d), (e), "f", "g", "h" and "j" of the Regulation are inapplicable and inappropriate in this case, given the gravity of the infringement and the fact that it has been completed and is irreversible. In the present case, the pecuniary sanction provided for in Article 58 (2) (i) of the Regulation is the most appropriate, effective, dissuasive and proportionate for the protection of the legitimate public interest. It should be noted that in addition to a purely sanction measure, a reaction of the state to the violation of the statutory rules, the property sanction also has a disciplinary effect, in view of the non-commission of the same violation in the future. The administrator is obliged to know the law and to observe its requirements, moreover, that he owes the necessary care provided by law and arising from his subject of activity, human and economic resources.<br />
In determining the amount of the sanction and in accordance with the conditions under Art. 83, § 2 of the Regulation, the commission took into account that it was a violation of the rights of a natural person. As aggravating circumstances were reported that the violation is irreparable, and the same has become known to the CPDP as a result of its referral by the victim. The commission also considers as an aggravating circumstance the fact that data on a person's unique civil number have been processed, as well as that it concerns the processing of personal data in order to create political affiliation with views and policies expressed by the political entity, as well as restriction of rights related to electoral legislation. In choosing the corrective power, and in determining the amount of the sanction, the commission also took into account that the violation is not the first, but consecutively for the administrator who is sanctioned for an identical violation by Decision No. G-792/2016 of the CPDP, and his behavior in processing personal data in the election process was sanctioned by Decision R-755 / 02.09.2015 of the Commission, which entered into force. The circumstances under Art. 83, § 2, letters “b” and “i” of the Regulation are irrelevant as far as the administrator is concerned - a legal entity that does not form a fault, and at the time of the violation approved codes of conduct, respectively approved certification mechanisms are not introduced.<br />
The Commission considers that, in view of the principle of proportionality between the gravity of the infringement and the amount of the penalty imposed on P.P. a pecuniary sanction should amount to BGN 2,000 - an amount well below the average minimum provided for in the Regulation for this violation. Taking into account the purpose of the penalty, which should have a deterrent and warning function, the nature and severity of the violation, the public relations it affects, the categories of personal data concerned, the Commission considers that the powers exercised in type and amount indisputably 679 efficiency and deterrent effect, while not violating the principle of proportionality and the requirement of proportionality.<br />
Guided by the above and on the grounds of Art. 38, para. 3 of LPPD, the Commission for Personal Data Protection, HAS DECIDED AS FOLLOWS:<br />
1. Announces complaint No. ppN-01-433 / 03.05.2019, filed by J.L. against political<br />
party, for justified.<br />
2. On the grounds of art. 83, § 5, letter “a”, in connection with Art. 58, § 2, letter “i” of Regulation (EU) 2016/679 imposes on a political party with Bulstat ********** an administrative penalty - a property sanction in the amount of BGN 2,000 (two thousand levs) for processing the personal data of the complainant in violation of Art. 6, § 1 of the Regulation.<br />
The decision is subject to appeal within 14 days of its service, through the Commission for Personal Data Protection, before the Administrative Court of Sofia - city.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VSRS_Sklep_I_Upr_1/2020&diff=10274VSRS Sklep I Upr 1/20202020-05-20T14:11:11Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VSRS Sklep I Upr 1/2020<br />
|-<br />
|Court:||[[:Category:VSRS (Slovenia)|VSRS (Slovenia)]]<br />
[[Category:VSRS (Slovenia)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Slovenia|Slovenia]]<br />
[[Category:Slovenia]]<br />
|-<br />
|Relevant Law:||Data Protection Act (ZVOP-1)<br />
|-<br />
|Decided:||26.2.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||VSRS Sklep I Upr 1/2020 (VS00032203)<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:SI:VSRS:2020:I.UPR.1.2020</small><br />
|-<br />
|Appeal from:||Uknown<br />
|-<br />
|Language:||Slovenian<br />
[[Category:Slovenian]]<br />
|-<br />
|Original Source:||[http://www.sodnapraksa.si/search.php?q=ZVOP&database%5bSOVS%5d=SOVS&database%5bIESP%5d=IESP&database%5bUPRS%5d=UPRS&database%5bNEGM%5d=NEGM&_submit=i%C5%A1%C4%8Di&order=date&direction=asc&rowsPerPage=20&page=16&id=2015081111436184Sodna Praksa (in SI)]<br />
|}<br />
<br />
The Supreme Court of Slovenia while ruling on a jurisdictional dispute found that the Data Protection Act (ZVOP-1) is not applicable when an acces request is submitted by a company. <br />
<br />
==English Summary==<br />
===Facts=== <br />
The applicant brought an action against the defendant in the Ljubljana District Court, requesting that the defendant, a Bank, provide him with all identifying information about the recipients of transfers made against a particular transaction account held by the claimant's debtor. The District Court ruled that it had no material jurisdiction and remitted the case to the Administrative Court by referring to the Data Protection Act (ZVOP-1) and stating that the applicant acts as data subject and the defendant (bank) as a data controller. The claimant modified its claim. The Administrative Court dismissed the action. <br />
<br />
===Dispute=== <br />
The dispute regarded the competence of the Administrative and District Court. The question was whether it is a private-law dispute between two civil persons, or a dispute which the administrative court is competent to decide as a specialized court.<br />
<br />
===Holding===<br />
The Supreme Court found that the District Court of Ljubljana is competent to decide the case. As to what is important to us ZVOP is not applicable because both the plaintiff and the defendant are companies.<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the original. Please refer to the Slovenian original for more details.<br />
<br />
<pre><br />
Record number: VS00032203<br />
Decision date: 02/26/2020<br />
Senate: Peter Golob (Pres.), M.Sc. Tatjana Steinman (Report), Vladimir Balazic<br />
Subject matter: PUBLIC LAW - CIVIL PROCEDURAL LAW - ADMINISTRATIVE DISPUTE - PROTECTION OF PERSONAL DATA<br />
Institute: Provision of personal information to the creditor - Bank as the person liable to provide information - Jurisdiction dispute - Jurisdiction dispute between the District Court and the Administrative Court - Not an administrative dispute - Economic dispute<br />
Sail<br />
<br />
The defendant, as a bank, does not issue administrative acts, so it does not decide on the provision of the required information by an administrative act.<br />
<br />
In the present case, this is not a dispute under Articles 2 and 4 of ZUS-1, for which the Administrative Court of the Republic of Slovenia would have jurisdiction as a specialized court for administrative disputes.<br />
<br />
The jurisdiction of the Administrative Court is not determined by Article 34 of ZVOP-1 for enforcing the obligation to provide data, although such an obligation is also stipulated by this Act. Article 34 provides for judicial protection in an administrative dispute only to an individual who finds that his / her rights established by this Act have been violated.<br />
<br />
Since ZVOP-1 does not define the jurisdiction of the Administrative Court as a specialized court for deciding on a claim, only a court of general jurisdiction can be competent under Article 1 of the ZPP.<br />
Theorem<br />
<br />
The District Court of Ljubljana is competent to decide the case.<br />
Justification<br />
<br />
The process so far<br />
<br />
1. The applicant brought an action against the defendant in the Ljubljana District Court, requesting that the defendant provide him with all identifying information about the recipients of transfers made against a particular transaction account held by the claimant's debtor. (hereinafter referred to as the debtor). She stated that she had a final and enforceable enforcement order, on the basis of which the debtor would have to pay her the amount stated therein, and before the final decision on the execution, the debtor transferred money from her account to an unknown third party's account and died shortly thereafter.<br />
2. By a decision of 27 February 2017, the District Court ruled that it had no material jurisdiction and remitted the case to the Administrative Court. In doing so, it referred to the provisions of the Personal Data Protection Act (hereinafter ZVOP-1) and stated that the applicant was acting as a data user and the defendant as a data controller. The applicant's appeal against this decision was dismissed by the High Court and the case was referred to the Administrative Court. Consequently, the plaintiff modified the application or claim, requesting that the Administrative Court rule that the defendant is obliged to provide the plaintiff with all identifying information about the recipients of the remittances available to him or her for the transactions specified therein, or in the alternative, order the Administrative Court to dismiss the letters (indicated therein) dated 26 April 2014, 8 July 2015, 29 July 2015, 2 September 2015 and 26 November 2015 and remit the case to the defendant for retrial .<br />
<br />
3. By judgment of I U 1854/2017 of 22.11.2017, the Administrative Court upheld the applicant's action by stating that letter no. 4487 / B.Podjed-3/83 of 26 November 2015, dismissed and remanded the case to the defendant for reconsideration.<br />
<br />
4. The defendant lodged an appeal against the judgment of the court of first instance (which the Supreme Court allowed by order X DoR 6/2018 of 18.4.2018) and the Supreme Court by decision X Ips 24/2018 of 13. 11. On 2019, the Court granted the review and the judgment of the Administrative Court IU 1854 / 2017-42 of 22 January 2017 (which was based on the erroneous assessment that the administrative act was challenged in the present case) set aside and remitted the case to the court of first instance for a new trial. In the explanation of this order, the Supreme Court explained that banks are not obliged to make decisions in the administrative procedure, ie to issue decisions with all the components in accordance with the General Administrative Procedure Act (hereinafter ZUP), since Article 97 of the Banking Act (hereinafter referred to as ZBan- 2) it does not provide a basis for concluding that by obtaining a license to provide these services, the bank acquires the status of a public service provider, and ZVOP-1 does not provide a legal basis for deciding on requests or requests for personal data transmission to private entities (data controllers). with administrative decisions based on ZUP.<br />
<br />
5. In a repeated proceeding, the Administrative Court of the Republic of Slovenia initiated a dispute over jurisdiction. Referring to the reasons given in the decision of Supreme Court X Ips 24/2018, it considers that it does not have jurisdiction to decide the action and that the decisions of the Ljubljana District Court and the Ljubljana Higher Court are incorrect.<br />
Decision on jurisdiction dispute<br />
<br />
6. The District Court of Ljubljana is competent to decide the matter in this case.<br />
<br />
7. By an action brought by the applicant before the Ljubljana District Court, to the court of general jurisdiction, requires the defendant to fulfill its duty to provide the data referred to in point 19 of the first paragraph of Article 4 of the Law on Enforcement and Insurance (hereinafter referred to as ZIZ) 1 in relation to the first paragraph of Article 16a of ZIZ.2. immediately, within eight days at the latest, provide the required persons with the required information (Article 4, paragraph 8 of the IPA) It is therefore a statutory obligation of the bank as a legal entity to provide information for enforcement purposes. In doing so, the bank, as the controller of the databases or databases, is obliged to provide the data, at its request, to a creditor who has a legal interest.<br />
<br />
8. The plaintiff seeks the fulfillment of the obligation by his action, for which he claims that the provisions of Article 4 of the ZIZ establish it for the defendant. In doing so, the applicant submits, in fact, that the parties to the dispute are in essence the fulfillment of the defendant's obligations arising from another civil law relationship which is alleged to have arisen between the parties pursuant to Article 4 of the IPA. Both plaintiffs and defendants are companies.<br />
<br />
9. Neither ZIZ nor ZBan-2 explicitly specify how the judicial protection of the right referred to in the sixth paragraph of Article 4 of the ZIZ shall be exercised if the creditor requests information from the bank, which fails to fulfill this obligation to provide the data.3<br />
<br />
10. Pursuant to the first paragraph of Article 1 of the Code of Civil Procedure (hereinafter ZPP), a court of general jurisdiction shall hear and adjudicate in disputes arising from the property and other civil relations of natural and legal persons, unless any of these disputes is within the jurisdiction of a special law. a specialized court or other authority. In the present case, therefore, it is a question of whether it is a private-law dispute between two civil persons, or a dispute which is competent for the administrative court to decide as a specialized court.<br />
11. The Administrative Court, as a specialized court, has jurisdiction to rule on disputes for which this is provided by law. Thus, Article 1 of the Administrative Disputes Act (hereinafter ZUS-1) stipulates that judicial disputes guarantee the rights and legal benefits of individuals and organizations against decisions and actions of state bodies, local authorities and holders of public authority, if no other judicial protection is provided by law for a particular case. The administrative court is therefore competent to adjudicate disputes against public-law acts (or acts) of governing bodies, or persons who, by public authority, perform a public service.<br />
<br />
12. The defendant, however, is a bank that is a commercial company and not an authority of a state or local community. As already explained by the Supreme Court in Decision X Ips 24/2018, the defendant does not issue administrative acts as a bank, and therefore does not decide on the provision of the required information by an administrative act. Namely, by obtaining a license to provide banking and financial services, the Bank did not acquire the status of a public service provider either under the provisions of the Banking Act (ZBan-2) or under the provisions of the ZVOP-1, nor was it granted public authority to issue administrative decisions to decide on rights or obligations of natural or legal persons. Therefore, the reference made by the Ljubljana Higher Court to the judgment of the Administrative Court I U 284/2010 is unfounded, since the Administrative Court judged the legality of the administrative act, which it has jurisdiction under the provisions of ZUS-1.<br />
<br />
13. The basis for the jurisdiction of the Administrative Court is not even Article 4 of ZUS-1, which otherwise provides for an administrative dispute over interference with human rights and fundamental freedoms, unless other judicial protection is guaranteed. Judicial protection under this provision also applies to acts and actions of the authorities, and the defendant, as explained earlier, is not. Therefore, in the present case, this is not a dispute under Articles 2 and 4 of ZUS-1, for which the Administrative Court of the Republic of Slovenia would have jurisdiction as a specialized court for administrative disputes.<br />
14. The jurisdiction of the Administrative Court to adjudicate the present dispute is not determined even by Article 34 of the PDPA-1. The Ljubljana District Court and the Ljubljana Higher Court, however, based their decision on the lack of jurisdiction of the civil court on the view that the jurisdiction of the Administrative Court is based on the judicial protection provided by the said provision, since the provision of personal data is regulated by ZVOP-1 in Article 22, which that it also includes the rights referred to in the sixth paragraph of Article 4 of the IPA. In the opinion of the Supreme Court, such reasoning is incorrect, since the jurisdiction of the Administrative Court is not determined by Article 34 of ZVOP-1 to enforce the obligation to provide information, although such an obligation is also stipulated by this Act. Article 34 provides for judicial protection in an administrative dispute only to an individual who finds that his / her rights determined by this law have been violated.4 The claim alleging that the defendant does not wish to provide the plaintiff with the information referred to in point 19 of the first paragraph of Article 4 of the IPA, however, it does not constitute an infringement of the rights of an individual within the meaning of Article 34 of the PDPA-1, even if this obligation arises from Article 22 of the PDCA-1. Namely, according to point 2 of Article 6 of ZVOP-1, an individual is defined as an identified or identifiable natural person to whom personal data refers. In the present case, however, the plaintiff is not the kind of individual who would assert a violation of the rights that ZVOP-1 grants to these individuals. The fact that the Administrative Court is expected to rule in a similar case 5 as a competent court does not in itself have the potential to affect a different position of the Supreme Court.<br />
<br />
15. Since ZVOP-1 also does not determine the jurisdiction of the Administrative Court as a specialized court for adjudicating on a claim, as claimed by the plaintiff, therefore, only a court of general jurisdiction can have jurisdiction under Article 1 of the ZPP. As the plaintiff and defendant in the present case are companies, in accordance with the provisions of point 1 of the first paragraph of Article 481 of the CPA, in relation to the point 7 of the second paragraph of Article 32 of the CPA, and in accordance with Article 48 of the CPA, the District Court of Ljubljana has jurisdiction.<br />
<br />
16. In view of the above, the Supreme Court has ruled on the basis of the third paragraph of Article 12 of ZUS-1, as stated in the operative part.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=AP_(The_Netherlands)_-_30.04.2020&diff=10273AP (The Netherlands) - 30.04.20202020-05-20T14:04:51Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Netherlands<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoNL.png<br />
|DPA_Abbrevation=AP<br />
|DPA_With_Country=AP (The Netherlands)<br />
<br />
|Case_Number_Name=Fine for processing employees' fingerprints<br />
|ECLI=n/a<br />
<br />
|Original_Source_Name_1=AP <br />
|Original_Source_Link_1=https://autoriteitpersoonsgegevens.nl/nl/nieuws/boete-voor-bedrijf-voor-verwerken-vingerafdrukken-werknemers<br />
|Original_Source_Language_1=Dutch<br />
|Original_Source_Language__Code_1=NL<br />
<br />
|Type=Investigation<br />
|Outcome=Violation Found<br />
|Date_Decided=<br />
|Date_Published=30.04.2020<br />
|Year=2020<br />
|Fine=725,000<br />
|Currency=EUR<br />
<br />
|GDPR_Article_1=Article 9(2)(a) GDPR<br />
|GDPR_Article_Link_1=Article 9 GDPR#2a<br />
|GDPR_Article_2=Article 9(2)(b) GDPR<br />
|GDPR_Article_Link_2=Article 9 GDPR#2b<br />
<br />
<br />
<br />
|Party_Name_1=Unknown<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=Pending appeal<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Dutch DPA (AP) fined a company 725,000 € for the unlawful processing of biometric data of employees. The company failed to demonstrate that it had obtained the employees' explicit consent.<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
"Employees of a company have had their fingerprints scanned for attendance and time registration."<br />
<br />
===Dispute===<br />
<br />
<br />
===Holding===<br />
"After investigation, the Personal Data Authority (AP) concluded that the company should not have processed fingerprints of employees. Indeed, the company cannot invoke an exceptional ground for processing special personal data. The company will be fined EUR 725,000 for this. [...] For the use of fingerprints, two exceptions to the prohibition could be possible in this case: if explicit consent of the data subjects is requested or if the use of biometric data is necessary for authentication or security purposes. The AP concluded that this company cannot invoke one of these two exceptions for the collection, storage and use of employees' fingerprints. [...] This company has not demonstrated that the employees have given explicit consent. Employees have also experienced the recording of their fingerprint as an obligation."<br />
<br />
==Comment==<br />
<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.<br />
<br />
<pre><br />
Fine for company for processing fingerprints employees<br />
News Release/30 April 2020<br />
Category:<br />
<br />
Biometrics<br />
Control of employees<br />
<br />
Employees of a company have had their fingerprints scanned for attendance and time registration. After investigation, the Personal Data Authority (AP) concluded that the company should not have processed fingerprints of employees. Indeed, the company cannot invoke an exceptional ground for processing special personal data. The company will be fined EUR 725,000 for this.<br />
Special personal data<br />
<br />
Biometric data, such as a fingerprint, are special personal data. An organization may not use special personal information, unless the law provides for an exception.<br />
<br />
Monique Verdier, vice-president of the AP: 'This category of personal data is extra protected by law. If this data gets into the wrong hands, it can possibly lead to irreparable damage. Such as blackmail or identity fraud. A fingerprint is not replaceable, such as a password. If it goes wrong, the impact can be great and can have a lifelong negative effect on someone'.<br />
No exception to prohibition<br />
<br />
For the use of fingerprints, 2 exceptions to the prohibition could be possible in this case: if explicit consent of the data subjects is requested or if the use of biometric data is necessary for authentication or security purposes.<br />
<br />
The AP concluded that this company cannot invoke 1 of these 2 exceptions for the collection, storage and use of employees' fingerprints.<br />
Security<br />
<br />
An employer may ask an employee to give a fingerprint for, for example, access control. Sometimes an employee is obliged to give his fingerprint, sometimes not. This depends on whether the processing of the fingerprint is necessary for authentication or security.<br />
<br />
An employer has to consider whether buildings and information systems have to be so secure that this cannot be done other than by using (only) biometrics. This will often not be necessary, because there are good alternatives.<br />
Permission<br />
<br />
Does an employer ask employees for permission to process their fingerprint? In principle, this is not allowed. Employees are dependent on their employer, so often not in a position to refuse.<br />
<br />
The privacy law sets strict requirements for requesting explicit permission. Permission must be unambiguous, specific, informed and free.<br />
<br />
This company has not demonstrated that the employees have given explicit permission. Employees have also experienced the recording of their fingerprint as an obligation.<br />
Legal remedies<br />
<br />
The organisation objected to the AP's decision. The name of the organisation will not be made public by a court decision.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051604&diff=10270Persónuvernd - 20200516042020-05-20T12:16:35Z<p>Juliette Leportois: /* English Machine Translation of the Decision */</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Iceland<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoIS.png<br />
|DPA_Abbrevation=Persónuvernd<br />
|DPA_With_Country=Persónuvernd (Iceland)<br />
<br />
|Case_Number_Name=nr. 2020051604<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Persónuvernd<br />
|Original_Source_Link_1=https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar<br />
|Original_Source_Language_1=Icelandic<br />
|Original_Source_Language__Code_1=IS<br />
<br />
|Type=Advisory Opinion<br />
|Outcome=<br />
|Date_Decided=<br />
|Date_Published=13.05.2020<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 2 GDPR<br />
|GDPR_Article_Link_1=Article 2 GDPR<br />
|GDPR_Article_2=Article 4(1) GDPR<br />
|GDPR_Article_Link_2=Article 4 GDPR#1<br />
<br />
<br />
|National_Law_Name_1=Information Act no. 140/2012 <br />
|National_Law_Link_1=http://ilo.org/dyn/natlex/natlex4.detail?p_lang=en&p_isn=95342&p_count=96232<br />
|National_Law_Name_2=Privacy Act no. 90/2018<br />
|National_Law_Link_2=https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_Data.pdf<br />
<br />
|Party_Name_1=Dictorate of Labour<br />
|Party_Link_1=https://www.vinnumalastofnun.is/en/foreign-workers<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Icelandic DPA (Persónuvernd) issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act, implementing the GDPR. Although the Persónuvernd was not competent to rule on the lawfulness of a disclosure of personal data under the Information act, it ruled that the Privacy Act does not prevent the information in question from being published.<br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Icelandic Dictorate of Labour holds companies’ information using partial compensation schemes and employees’ information on their applications for unemployment benefits in accordance with Act no. 54/2006 on unemployment insurance (part-time work under Corona crises).<br />
<br />
The Dictorate of Labour received a request to publish the companies’ and employees’ information under the Information Act no 140/2012. Following this access request, the Dictorate asked the Data protection authority’s opinion on the lawfulness of the disclosure. <br />
<br />
More precisely, the Dictorate asked whether it will be compliant with the Privacy Act that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.<br />
<br />
=== Holding ===<br />
First, the authority clarified the interplay between the two legal text and pointed out that the Privacy Act does not limit the right of access laid down in the Information Act. <br />
The data protection authority held that the disclosure of companies’ information under the Information Act no. 140/2012 is not under its jurisdiction. However, the data protection authority is competent to issue decision under the Privacy Act no. 90/2018 on privacy and processing of personal information.<br />
<br />
Then, the authority pointed out that companies’ information about who applied for unemployment benefits is a personal data. Indeed, the authorized held that the concept of personal data does not only apply to information about individuals but also to organizations, companies or other legal entities.<br />
<br />
Moreover, the authority held that the purposes of the disclosure of the companies’ information using the partial compensation schemes are to safeguard the public interest and promote corporate restraint. In this regard, the authority pointed out that to exclude from the publication small businesses will not fulfill the purposes of partial compensation schemes.<br />
<br />
Lastly, the authority ruled that there is onthing in the Privacy Act which prevent the information in question from being published. Thus, the authority answered that the Privacy Act which does not prevent the information about companies using a partial benefit scheme from being published.<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.<br />
<br />
<pre><br />
https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar<br />
Response of the Data Protection Authority to the Directorate of Labor regarding the publication of information on utilization of partial compensation schemes<br />
Case no. 2020051604<br />
<br />
05/13/2020<br />
<br />
On May 11, 2020, the Directorate of Labor received a letter from the Directorate of Labor regarding the publication and dissemination of information about the companies that have employees who have used so-called partial compensation schemes in accordance with Act no. 54/2006 on unemployment insurance. The letter posed questions related to the disclosure of the information in question and how it complied with the Privacy Act. In the response of the Data Protection Authority, it is stated, among other things, that the Agency believes that the publication and dissemination of the information in question is in accordance with the Information Act no. 140/2012 and that the Data Protection Authority does not rule on the legality of the disclosure of information under that Act. However, it is the position of the Data Protection Authority that Act no. 90/2018 on privacy and processing of personal information did not prevent the information in question from being published.<br />
<br />
<br />
Reykjavik, May 12, 2020<br />
<br />
Subject: Response to the Directorate of Labor<br />
<br />
Privacy refers to the letter from the Directorate of Labor, dated. May 11, 2020. The letter traces the amendments made to Act no. 54/2006 on unemployment insurance in March 2020, which transposes the provision for so-called part-time work. The move included encouraging employers to maintain employment and temporarily reduce their employment rate rather than retrench. The Directorate of Labor has now received a request to hand over and publish a list of the companies that have agreed with their employees on a reduced rate of employment, together with the number of their employees who applied for unemployment benefits at the Directorate of Labor. The letter also states that the Directorate of Labor will pay unemployment benefits to individuals on the basis of applications from them, but that companies are not paid benefits on the basis of the aforementioned partial compensation in Act no. 54/2006.<br />
<br />
The letter also states that the Directorate of Labor has not considered itself permitted to submit or publish information from the unemployment register without clear legal basis. Although information on companies, such as this, has been requested, there is an overwhelming likelihood that such disclosure will involve the processing of personal information, which includes which individuals will receive unemployment benefits or the likelihood that they will be accept unemployment benefits at the same time as reduced employment rates.<br />
<br />
In view of this, the Directorate of Labor requested the Privacy Protection Opinion on the questions discussed in Chapter 2.<br />
1.<br />
General points of view<br />
<br />
According to the first paragraph. Article 13 Information Act, no. 140/2012, the government is required to provide the public with information on its activities on a regular basis, such as through the electronic publishing of reports, summaries of important projects or the publication of other documents. Then the second paragraph of Art. the provision that the government should work systematically to make records of cases, list of case documents and the data itself accessible by electronic means. The same applies to databases and files. Care should be taken that disclosure does not go against private or public interest.<br />
<br />
In the comments on the provision in the memorandum with a bill that became Act no. 140/2012 states, among other things, that it is important to promote that the government can, on its own initiative, inform about the issues they are pursuing at any time, without compromising privacy or important public interests. As a result of the provision, the government can, on its own initiative, decide to make public much of the information they have available, provided that the provisions of the Confidentiality and Privacy Act do not therefore interfere.<br />
<br />
The Data Protection Authority considers that the Directorate of Labor must decide on requests made on the basis of a cited provision. In this connection, the Data Protection Authority also points out that according to par. Article 5 Act no. 90/2018 on Privacy and the Processing of Personal Information does not limit the right of access laid down in the Information Act. As stated in Section 2.1, Act no. 90/2018 in addition not to legal persons.<br />
<br />
The aforementioned provisions result in a self-interest assessment being made before access to information is provided. Among other things, it is necessary to assess whether these are data on interests that are fair and natural for secrecy. Such an interest assessment must also take into account privacy considerations as well as public interests.<br />
<br />
Privacy Protection believes that it must be based on public interest to provide information about the companies that have employees who applied for benefits at the Directorate of Labor on the basis of XIII. Provisional provision in Act no. 54/2006, will be made available. In this context, it is noted that high economic interests are tied to the payment of benefits under the provision. It must also be considered that such access can create restraint for companies that choose to reduce the proportion of their employees, with a view to receiving benefits based on the provision. Finally, it is considered to be a government-specific measure that covers a broad group of people.<br />
In addition, the Data Protection Authority must bear in mind that information about the persons receiving benefits under XIII. Provisional provision in Act no. 54/2006 cannot be considered as sensitive personal information within the meaning of Paragraph 3. Article 3 Act no. 90/2018.<br />
2.<br />
Answers to questions from the Directorate of Labor<br />
2.1.<br />
<br />
First of all, the Directorate of Labor is asked whether the Data Protection Authority considers that information about the employers of the individuals who applied for payments from the Directorate of Labor is considered to be personal information within the meaning of item 2. Article 3 Act no. 90/2018.<br />
<br />
Privacy notes that in the comments on Art. in a memorandum with a bill that became Act no. 90/2018 states, among other things, that the concept of personal information is comprehensive and covers all information, opinions and opinions that may be directly or indirectly linked to a particular person, ie. information that is personally identifiable or identifiable. The comments also state that the regulation assumes that the concept of personal information applies only to information about individuals but not to organizations, companies or other legal entities.<br />
<br />
Privacy is of the opinion that information on companies that have employees who receive benefits from the Directorate of Labor on the basis of XIII should be based on information. Provisional provision in Act no. 54/2006 is not considered to be personal information as it is inherently related to companies. Nonetheless, Privacy Protection considers it appropriate to point out that in some cases personal information may be derived from such information, for example in the case of companies with few employees or in the case of companies with a relatively high number of employees. accept compensation on the basis of the provision.<br />
2.2.<br />
<br />
Second, the Directorate of Labor asks if the Data Protection Authority considers it sufficient action to ensure that it is not possible to identify applicants for unemployment benefits, that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.<br />
<br />
Privacy may agree that, by disclosing information on small businesses, it may be easier to derive personal information from those applying for the above benefits. However, to see that the purpose of making the information in question accessible is to safeguard the public interest and promote corporate restraint. In the opinion of the Data Protection Authority, it is likely that this purpose will not be fully achieved if a company with few employees is completely excluded from the publication or if the number of employees who do not receive benefits on the basis of XIII is not disclosed. Provisional provision in Act no. 54/2006. In this connection, the Data Protection Authority points out that there is not always a connection between the number of companies and their financial position.<br />
2.3.<br />
<br />
Thirdly, the Directorate of Labor asks if the Data Protection Authority considers that the processing in question is authorized in accordance with Article 9. Act no. 90/2018 having regard to the purpose of the disclosure of the information.<br />
<br />
The Data Protection Authority reiterates its position that the request is processed in accordance with the provisions of Information Act no. 140/2012. As discussed before, in making this decision, a self-interest assessment must be carried out where private and public interests are examined. Among other things, needs to consider privacy considerations in that assessment.<br />
<br />
The Data Protection Authority points out that in the case of the processing of personal data that falls within the scope of Act no. 90/2018 must be considered to be able to process personal information if it is necessary for a work that is in the public interest, cf. Item 5 Article 9 Act no. 90/2018 and paragraph 3 e. Article 6 Regulation (EU) 2016/679.<br />
3.<br />
Conclusion<br />
<br />
Privacy protects that it does not rule on the legitimacy of the provision of information pursuant to the Information Act no. 140/2012. However, it is the position of the Data Protection Authority that Act no. 90/2018 on Privacy and Processing of Personal Information did not prevent the disclosure or disclosure of information about companies that have employees who have used a partial benefit scheme under XIII. Provisional provisions in Act no. 54/2006.<br />
<br />
For the Data Protection,<br />
<br />
Helga Þórisdóttir Þórður Sveinsson<br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051604&diff=10269Persónuvernd - 20200516042020-05-20T12:16:28Z<p>Juliette Leportois: /* English Summary */</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Iceland<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoIS.png<br />
|DPA_Abbrevation=Persónuvernd<br />
|DPA_With_Country=Persónuvernd (Iceland)<br />
<br />
|Case_Number_Name=nr. 2020051604<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Persónuvernd<br />
|Original_Source_Link_1=https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar<br />
|Original_Source_Language_1=Icelandic<br />
|Original_Source_Language__Code_1=IS<br />
<br />
|Type=Advisory Opinion<br />
|Outcome=<br />
|Date_Decided=<br />
|Date_Published=13.05.2020<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 2 GDPR<br />
|GDPR_Article_Link_1=Article 2 GDPR<br />
|GDPR_Article_2=Article 4(1) GDPR<br />
|GDPR_Article_Link_2=Article 4 GDPR#1<br />
<br />
<br />
|National_Law_Name_1=Information Act no. 140/2012 <br />
|National_Law_Link_1=http://ilo.org/dyn/natlex/natlex4.detail?p_lang=en&p_isn=95342&p_count=96232<br />
|National_Law_Name_2=Privacy Act no. 90/2018<br />
|National_Law_Link_2=https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_Data.pdf<br />
<br />
|Party_Name_1=Dictorate of Labour<br />
|Party_Link_1=https://www.vinnumalastofnun.is/en/foreign-workers<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Icelandic DPA (Persónuvernd) issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act, implementing the GDPR. Although the Persónuvernd was not competent to rule on the lawfulness of a disclosure of personal data under the Information act, it ruled that the Privacy Act does not prevent the information in question from being published.<br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Icelandic Dictorate of Labour holds companies’ information using partial compensation schemes and employees’ information on their applications for unemployment benefits in accordance with Act no. 54/2006 on unemployment insurance (part-time work under Corona crises).<br />
<br />
The Dictorate of Labour received a request to publish the companies’ and employees’ information under the Information Act no 140/2012. Following this access request, the Dictorate asked the Data protection authority’s opinion on the lawfulness of the disclosure. <br />
<br />
More precisely, the Dictorate asked whether it will be compliant with the Privacy Act that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.<br />
<br />
=== Holding ===<br />
First, the authority clarified the interplay between the two legal text and pointed out that the Privacy Act does not limit the right of access laid down in the Information Act. <br />
The data protection authority held that the disclosure of companies’ information under the Information Act no. 140/2012 is not under its jurisdiction. However, the data protection authority is competent to issue decision under the Privacy Act no. 90/2018 on privacy and processing of personal information.<br />
<br />
Then, the authority pointed out that companies’ information about who applied for unemployment benefits is a personal data. Indeed, the authorized held that the concept of personal data does not only apply to information about individuals but also to organizations, companies or other legal entities.<br />
<br />
Moreover, the authority held that the purposes of the disclosure of the companies’ information using the partial compensation schemes are to safeguard the public interest and promote corporate restraint. In this regard, the authority pointed out that to exclude from the publication small businesses will not fulfill the purposes of partial compensation schemes.<br />
<br />
Lastly, the authority ruled that there is onthing in the Privacy Act which prevent the information in question from being published. Thus, the authority answered that the Privacy Act which does not prevent the information about companies using a partial benefit scheme from being published.<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.<br />
<br />
<pre><br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051604&diff=10268Persónuvernd - 20200516042020-05-20T12:15:19Z<p>Juliette Leportois: Created page with "{{DPAdecisionBOX |Jurisdiction=Iceland |DPA-BG-Color= |DPAlogo=LogoIS.png |DPA_Abbrevation=Persónuvernd |DPA_With_Country=Persónuvernd (Iceland) |Case_Number_Name=nr. 2020..."</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Iceland<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoIS.png<br />
|DPA_Abbrevation=Persónuvernd<br />
|DPA_With_Country=Persónuvernd (Iceland)<br />
<br />
|Case_Number_Name=nr. 2020051604<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Persónuvernd<br />
|Original_Source_Link_1=https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar<br />
|Original_Source_Language_1=Icelandic<br />
|Original_Source_Language__Code_1=IS<br />
<br />
|Type=Advisory Opinion<br />
|Outcome=<br />
|Date_Decided=<br />
|Date_Published=13.05.2020<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 2 GDPR<br />
|GDPR_Article_Link_1=Article 2 GDPR<br />
|GDPR_Article_2=Article 4(1) GDPR<br />
|GDPR_Article_Link_2=Article 4 GDPR#1<br />
<br />
<br />
|National_Law_Name_1=Information Act no. 140/2012 <br />
|National_Law_Link_1=http://ilo.org/dyn/natlex/natlex4.detail?p_lang=en&p_isn=95342&p_count=96232<br />
|National_Law_Name_2=Privacy Act no. 90/2018<br />
|National_Law_Link_2=https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_Data.pdf<br />
<br />
|Party_Name_1=Dictorate of Labour<br />
|Party_Link_1=https://www.vinnumalastofnun.is/en/foreign-workers<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Icelandic DPA (Persónuvernd) issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act, implementing the GDPR. Although the Persónuvernd was not competent to rule on the lawfulness of a disclosure of personal data under the Information act, it ruled that the Privacy Act does not prevent the information in question from being published.<br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The Icelandic Dictorate of Labour holds companies’ information using partial compensation schemes and employees’ information on their applications for unemployment benefits in accordance with Act no. 54/2006 on unemployment insurance (part-time work under Corona crises).<br />
<br />
The Dictorate of Labour received a request to publish the companies’ and employees’ information under the Information Act no 140/2012. Following this access request, the Dictorate asked the Data protection authority’s opinion on the lawfulness of the disclosure. <br />
<br />
More precisely, the Dictorate asked whether it will be compliant with the Privacy Act that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.<br />
<br />
<br />
=== Dispute ===<br />
<br />
<br />
=== Holding ===<br />
First, the authority clarified the interplay between the two legal text and pointed out that the Privacy Act does not limit the right of access laid down in the Information Act. <br />
The data protection authority held that the disclosure of companies’ information under the Information Act no. 140/2012 is not under its jurisdiction. However, the data protection authority is competent to issue decision under the Privacy Act no. 90/2018 on privacy and processing of personal information.<br />
<br />
Then, the authority pointed out that companies’ information about who applied for unemployment benefits is a personal data. Indeed, the authorized held that the concept of personal data does not only apply to information about individuals but also to organizations, companies or other legal entities.<br />
<br />
Moreover, the authority held that the purposes of the disclosure of the companies’ information using the partial compensation schemes are to safeguard the public interest and promote corporate restraint. In this regard, the authority pointed out that to exclude from the publication small businesses will not fulfill the purposes of partial compensation schemes.<br />
<br />
Lastly, the authority ruled that there is onthing in the Privacy Act which prevent the information in question from being published. Thus, the authority answered that the Privacy Act which does not prevent the information about companies using a partial benefit scheme from being published.<br />
<br />
<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.<br />
<br />
<pre><br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10267APD/GBA (Belgium) - 17/20202020-05-20T10:07:24Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 12(3) GDPR<br />
|GDPR_Article_Link_1=Article 12 GDPR#3<br />
|GDPR_Article_2=Article 15(1) GDPR<br />
|GDPR_Article_Link_2=Article 15 GDPR#1<br />
|GDPR_Article_3=Article 15(3) GDPR<br />
|GDPR_Article_Link_3=Article 15 GDPR#3<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered access requests under Article 15 GDPR. <br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019. <br />
<br />
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
<br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
===Dispute===<br />
The authority has to clarify the scope of application of Article 15 GDPR. <br />
<br />
===Holding===<br />
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR. <br />
<br />
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.<br />
<br />
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.<br />
<br />
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR<br />
<br />
==Comment==<br />
<br />
''share your comment here!''<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VSRS_Sklep_I_Upr_1/2020&diff=10262VSRS Sklep I Upr 1/20202020-05-19T11:55:20Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" | VSRS Sklep I Upr 1/2020<br />
|-<br />
|Court:||[[:Category:VSRS (Slovenia)|VSRS (Slovenia)]] [[Category:VSRS (Slovenia)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Slovenia|Slovenia]] [[Category:Slovenia]]<br />
|-<br />
|Relevant Law:||Data Protection Act (ZVOP-1)<br />
|-<br />
|Decided:||26.2.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||VSRS Sklep I Upr 1/2020 (VS00032203) <br />
|-<br />
|European Case Law Identifier:||<small>ECLI:SI:VSRS:2020:I.UPR.1.2020</small><br />
|-<br />
|Appeal from:||Uknown<br />
|-<br />
|Language:||Slovenian<br />
[[Category:Slovenian]]<br />
|-<br />
|Original Source:|| [http://www.sodnapraksa.si/search.php?q=ZVOP&database%5bSOVS%5d=SOVS&database%5bIESP%5d=IESP&database%5bUPRS%5d=UPRS&database%5bNEGM%5d=NEGM&_submit=i%C5%A1%C4%8Di&order=date&direction=asc&rowsPerPage=20&page=16&id=2015081111436184Sodna Praksa (in SI)]<br />
|}<br />
<br />
The Supreme Court of Slovenia while ruling on a jurisdictional dispute found that the Data Protection Act (ZVOP-1) is not applicable when a request for information is submitted by a company. <br />
<br />
==English Summary==<br />
===Facts=== <br />
The applicant brought an action against the defendant in the Ljubljana District Court, requesting that the defendant, a Bank, provide him with all identifying information about the recipients of transfers made against a particular transaction account held by the claimant's debtor. The District Court ruled that it had no material jurisdiction and remitted the case to the Administrative Court by referring to the Data Protection Act (ZVOP-1) and stating that the applicant acts as data subject and the defendant (bank) as a data controller. The claimant modified its claim. The Administrative Court dismissed the action. <br />
<br />
===Dispute=== <br />
The dispute regarded the competence of the Administrative and District Court. The question was whether it is a private-law dispute between two civil persons, or a dispute which the administrative court is competent to decide as a specialized court.<br />
<br />
===Holding===<br />
The Supreme Court found that the District Court of Ljubljana is competent to decide the case. As to what is important to us ZVOP is not applicable because both the plaintiff and the defendant are companies.<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the original. Please refer to the Slovenian original for more details.<br />
<br />
<pre><br />
Record number: VS00032203<br />
Decision date: 02/26/2020<br />
Senate: Peter Golob (Pres.), M.Sc. Tatjana Steinman (Report), Vladimir Balazic<br />
Subject matter: PUBLIC LAW - CIVIL PROCEDURAL LAW - ADMINISTRATIVE DISPUTE - PROTECTION OF PERSONAL DATA<br />
Institute: Provision of personal information to the creditor - Bank as the person liable to provide information - Jurisdiction dispute - Jurisdiction dispute between the District Court and the Administrative Court - Not an administrative dispute - Economic dispute<br />
Sail<br />
<br />
The defendant, as a bank, does not issue administrative acts, so it does not decide on the provision of the required information by an administrative act.<br />
<br />
In the present case, this is not a dispute under Articles 2 and 4 of ZUS-1, for which the Administrative Court of the Republic of Slovenia would have jurisdiction as a specialized court for administrative disputes.<br />
<br />
The jurisdiction of the Administrative Court is not determined by Article 34 of ZVOP-1 for enforcing the obligation to provide data, although such an obligation is also stipulated by this Act. Article 34 provides for judicial protection in an administrative dispute only to an individual who finds that his / her rights established by this Act have been violated.<br />
<br />
Since ZVOP-1 does not define the jurisdiction of the Administrative Court as a specialized court for deciding on a claim, only a court of general jurisdiction can be competent under Article 1 of the ZPP.<br />
Theorem<br />
<br />
The District Court of Ljubljana is competent to decide the case.<br />
Justification<br />
<br />
The process so far<br />
<br />
1. The applicant brought an action against the defendant in the Ljubljana District Court, requesting that the defendant provide him with all identifying information about the recipients of transfers made against a particular transaction account held by the claimant's debtor. (hereinafter referred to as the debtor). She stated that she had a final and enforceable enforcement order, on the basis of which the debtor would have to pay her the amount stated therein, and before the final decision on the execution, the debtor transferred money from her account to an unknown third party's account and died shortly thereafter.<br />
2. By a decision of 27 February 2017, the District Court ruled that it had no material jurisdiction and remitted the case to the Administrative Court. In doing so, it referred to the provisions of the Personal Data Protection Act (hereinafter ZVOP-1) and stated that the applicant was acting as a data user and the defendant as a data controller. The applicant's appeal against this decision was dismissed by the High Court and the case was referred to the Administrative Court. Consequently, the plaintiff modified the application or claim, requesting that the Administrative Court rule that the defendant is obliged to provide the plaintiff with all identifying information about the recipients of the remittances available to him or her for the transactions specified therein, or in the alternative, order the Administrative Court to dismiss the letters (indicated therein) dated 26 April 2014, 8 July 2015, 29 July 2015, 2 September 2015 and 26 November 2015 and remit the case to the defendant for retrial .<br />
<br />
3. By judgment of I U 1854/2017 of 22.11.2017, the Administrative Court upheld the applicant's action by stating that letter no. 4487 / B.Podjed-3/83 of 26 November 2015, dismissed and remanded the case to the defendant for reconsideration.<br />
<br />
4. The defendant lodged an appeal against the judgment of the court of first instance (which the Supreme Court allowed by order X DoR 6/2018 of 18.4.2018) and the Supreme Court by decision X Ips 24/2018 of 13. 11. On 2019, the Court granted the review and the judgment of the Administrative Court IU 1854 / 2017-42 of 22 January 2017 (which was based on the erroneous assessment that the administrative act was challenged in the present case) set aside and remitted the case to the court of first instance for a new trial. In the explanation of this order, the Supreme Court explained that banks are not obliged to make decisions in the administrative procedure, ie to issue decisions with all the components in accordance with the General Administrative Procedure Act (hereinafter ZUP), since Article 97 of the Banking Act (hereinafter referred to as ZBan- 2) it does not provide a basis for concluding that by obtaining a license to provide these services, the bank acquires the status of a public service provider, and ZVOP-1 does not provide a legal basis for deciding on requests or requests for personal data transmission to private entities (data controllers). with administrative decisions based on ZUP.<br />
<br />
5. In a repeated proceeding, the Administrative Court of the Republic of Slovenia initiated a dispute over jurisdiction. Referring to the reasons given in the decision of Supreme Court X Ips 24/2018, it considers that it does not have jurisdiction to decide the action and that the decisions of the Ljubljana District Court and the Ljubljana Higher Court are incorrect.<br />
Decision on jurisdiction dispute<br />
<br />
6. The District Court of Ljubljana is competent to decide the matter in this case.<br />
<br />
7. By an action brought by the applicant before the Ljubljana District Court, to the court of general jurisdiction, requires the defendant to fulfill its duty to provide the data referred to in point 19 of the first paragraph of Article 4 of the Law on Enforcement and Insurance (hereinafter referred to as ZIZ) 1 in relation to the first paragraph of Article 16a of ZIZ.2. immediately, within eight days at the latest, provide the required persons with the required information (Article 4, paragraph 8 of the IPA) It is therefore a statutory obligation of the bank as a legal entity to provide information for enforcement purposes. In doing so, the bank, as the controller of the databases or databases, is obliged to provide the data, at its request, to a creditor who has a legal interest.<br />
<br />
8. The plaintiff seeks the fulfillment of the obligation by his action, for which he claims that the provisions of Article 4 of the ZIZ establish it for the defendant. In doing so, the applicant submits, in fact, that the parties to the dispute are in essence the fulfillment of the defendant's obligations arising from another civil law relationship which is alleged to have arisen between the parties pursuant to Article 4 of the IPA. Both plaintiffs and defendants are companies.<br />
<br />
9. Neither ZIZ nor ZBan-2 explicitly specify how the judicial protection of the right referred to in the sixth paragraph of Article 4 of the ZIZ shall be exercised if the creditor requests information from the bank, which fails to fulfill this obligation to provide the data.3<br />
<br />
10. Pursuant to the first paragraph of Article 1 of the Code of Civil Procedure (hereinafter ZPP), a court of general jurisdiction shall hear and adjudicate in disputes arising from the property and other civil relations of natural and legal persons, unless any of these disputes is within the jurisdiction of a special law. a specialized court or other authority. In the present case, therefore, it is a question of whether it is a private-law dispute between two civil persons, or a dispute which is competent for the administrative court to decide as a specialized court.<br />
11. The Administrative Court, as a specialized court, has jurisdiction to rule on disputes for which this is provided by law. Thus, Article 1 of the Administrative Disputes Act (hereinafter ZUS-1) stipulates that judicial disputes guarantee the rights and legal benefits of individuals and organizations against decisions and actions of state bodies, local authorities and holders of public authority, if no other judicial protection is provided by law for a particular case. The administrative court is therefore competent to adjudicate disputes against public-law acts (or acts) of governing bodies, or persons who, by public authority, perform a public service.<br />
<br />
12. The defendant, however, is a bank that is a commercial company and not an authority of a state or local community. As already explained by the Supreme Court in Decision X Ips 24/2018, the defendant does not issue administrative acts as a bank, and therefore does not decide on the provision of the required information by an administrative act. Namely, by obtaining a license to provide banking and financial services, the Bank did not acquire the status of a public service provider either under the provisions of the Banking Act (ZBan-2) or under the provisions of the ZVOP-1, nor was it granted public authority to issue administrative decisions to decide on rights or obligations of natural or legal persons. Therefore, the reference made by the Ljubljana Higher Court to the judgment of the Administrative Court I U 284/2010 is unfounded, since the Administrative Court judged the legality of the administrative act, which it has jurisdiction under the provisions of ZUS-1.<br />
<br />
13. The basis for the jurisdiction of the Administrative Court is not even Article 4 of ZUS-1, which otherwise provides for an administrative dispute over interference with human rights and fundamental freedoms, unless other judicial protection is guaranteed. Judicial protection under this provision also applies to acts and actions of the authorities, and the defendant, as explained earlier, is not. Therefore, in the present case, this is not a dispute under Articles 2 and 4 of ZUS-1, for which the Administrative Court of the Republic of Slovenia would have jurisdiction as a specialized court for administrative disputes.<br />
14. The jurisdiction of the Administrative Court to adjudicate the present dispute is not determined even by Article 34 of the PDPA-1. The Ljubljana District Court and the Ljubljana Higher Court, however, based their decision on the lack of jurisdiction of the civil court on the view that the jurisdiction of the Administrative Court is based on the judicial protection provided by the said provision, since the provision of personal data is regulated by ZVOP-1 in Article 22, which that it also includes the rights referred to in the sixth paragraph of Article 4 of the IPA. In the opinion of the Supreme Court, such reasoning is incorrect, since the jurisdiction of the Administrative Court is not determined by Article 34 of ZVOP-1 to enforce the obligation to provide information, although such an obligation is also stipulated by this Act. Article 34 provides for judicial protection in an administrative dispute only to an individual who finds that his / her rights determined by this law have been violated.4 The claim alleging that the defendant does not wish to provide the plaintiff with the information referred to in point 19 of the first paragraph of Article 4 of the IPA, however, it does not constitute an infringement of the rights of an individual within the meaning of Article 34 of the PDPA-1, even if this obligation arises from Article 22 of the PDCA-1. Namely, according to point 2 of Article 6 of ZVOP-1, an individual is defined as an identified or identifiable natural person to whom personal data refers. In the present case, however, the plaintiff is not the kind of individual who would assert a violation of the rights that ZVOP-1 grants to these individuals. The fact that the Administrative Court is expected to rule in a similar case 5 as a competent court does not in itself have the potential to affect a different position of the Supreme Court.<br />
<br />
15. Since ZVOP-1 also does not determine the jurisdiction of the Administrative Court as a specialized court for adjudicating on a claim, as claimed by the plaintiff, therefore, only a court of general jurisdiction can have jurisdiction under Article 1 of the ZPP. As the plaintiff and defendant in the present case are companies, in accordance with the provisions of point 1 of the first paragraph of Article 481 of the CPA, in relation to the point 7 of the second paragraph of Article 32 of the CPA, and in accordance with Article 48 of the CPA, the District Court of Ljubljana has jurisdiction.<br />
<br />
16. In view of the above, the Supreme Court has ruled on the basis of the third paragraph of Article 12 of ZUS-1, as stated in the operative part.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CE_-_N%C2%B0_431350&diff=10259CE - N° 4313502020-05-19T10:21:31Z<p>Juliette Leportois: </p>
<hr />
<div>The French Supreme Administrative Court (Conseil d'Etat "CE") ruled that the processing of personal data of people in psychiatric care without their consent for the prevention of terrorist radicalization does not fall within the GDPR scope. <br />
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |CE - N° 431350<br />
|-<br />
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:Conseil_D'Etat_photo.png|center|150px|link=Special:FilePath/Conseil_D'Etat_photo.png]]<br />
|-<br />
|Court:||[[:Category:CE (France)|CE (France)]]<br />
[[Category:CE (France)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in France|France]]<br />
[[Category:France]]<br />
|-<br />
|Relevant Law:||[[Category:Article 2(2) GDPR|Article 2 GDPR#2]]<br />
[[Article 2 GDPR#2a|Article 2(2)(a) GDPR]]<br />
|-<br />
|Decided:||27. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||CRPA, LDH and MGEN ASS Vs. French Republic<br />
|-<br />
|National Case number:||N° 431350<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:FR:CECHR:2020:431350.20200327</small><br />
|-<br />
|Appeal from:||CE acting as the first and last instance<br />
|-<br />
|Language:||French<br />
[[Category:French]]<br />
|-<br />
|Original Source:||[https://www.legifrance.gouv.fr/affichJuriAdmin.do?oldAction=rechJuriAdmin&idTexte=CETATEXT000041785967&fastReqId=662954110&fastPos=1 Légifrance(in FR)]<br />
|}<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, ''inter alia'', the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority.<br />
<br />
The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law.<br />
<br />
The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR.<br />
<br />
===Dispute===<br />
The Court had to assess which legal was applicable and whether the further processing is lawful.<br />
<br />
===Holding===<br />
<br />
The Supreme Administrative Court decided<br />
<br />
First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté)<br />
<br />
Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment<br />
<br />
Fourthly, the Court ruled that personal data related to health are lawfully processed for public interests.<br />
<br />
Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected.<br />
<br />
Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure.<br />
<br />
As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.<br />
<br />
==Comment==<br />
''Share your comment on the decision here!'' <br />
<br />
==Further Resources==<br />
''Share other blogs or news articles here!''<br />
<br />
See the CNIL's summary and comments [https://www.cnil.fr/fr/droit-au-dereferencement-le-conseil-detat-tire-les-consequences-des-arrets-de-la-cour-de-justice-de here]. <br />
<br />
==English Machine Translation of the Decision==<br />
<br />
<pre><br />
References<br />
Council of State<br />
<br />
N° 431350 <br />
ECLI:EN:CECHR:2020:431350.20200327<br />
Mentioned in the tables of the Lebon collection<br />
10th - 9th bedrooms combined<br />
Mrs Isabelle Lemesle, Rapporteur<br />
Mr Alexandre Lallet, public rapporteur<br />
<br />
<br />
reading of Friday 27 March 2020<br />
FRENCH REPUBLIC<br />
<br />
ON BEHALF OF THE FRENCH PEOPLE<br />
<br />
<br />
Full text<br />
Having regard to the following procedures:<br />
<br />
1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State:<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State :<br />
<br />
1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State :<br />
<br />
1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State :<br />
<br />
1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018;<br />
<br />
3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling;<br />
<br />
4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to :<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
....................................................................................<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
In view of the other parts of the files ;<br />
<br />
Seen:<br />
- the European Convention for the Protection of Human Rights and Fundamental Freedoms;<br />
- the Charter of Fundamental Rights of the European Union;<br />
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ;<br />
- the Public Health Code ;<br />
- the Internal Security Code ;<br />
- Law No. 78-17 of 6 January 1978;<br />
- the code of administrative justice;<br />
<br />
<br />
After hearing in public session:<br />
<br />
- the report of Mrs. Isabelle Lemesle, State Councillor;<br />
<br />
- the conclusions of Mr. Alexandre Lallet, Maître des requêtes;<br />
<br />
The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians;<br />
Considering the following:<br />
<br />
1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision.<br />
<br />
On the conclusions directed against the decree of 23 May 2018:<br />
<br />
2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)".<br />
<br />
3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible.<br />
<br />
On the conclusions directed against the decree of 6 May 2019:<br />
<br />
4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed.<br />
<br />
With regard to the admissibility of applications :<br />
<br />
5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree.<br />
<br />
6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree.<br />
<br />
As regards the intervention of UNAFAM :<br />
<br />
7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350.<br />
<br />
As regards the legality of the contested decree :<br />
<br />
8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted.<br />
<br />
9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016.<br />
<br />
11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded.<br />
<br />
12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed.<br />
<br />
13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree.<br />
<br />
14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him".<br />
<br />
15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed.<br />
<br />
16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative.<br />
<br />
17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed.<br />
<br />
18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions.<br />
<br />
19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits.<br />
<br />
20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter.<br />
<br />
21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings.<br />
<br />
<br />
<br />
<br />
D E C I D E :<br />
--------------<br />
Article 1: The intervention of UNAFAM is admitted.<br />
Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected.<br />
<br />
Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health.<br />
Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CE_-_N%C2%B0_431350&diff=10258CE - N° 4313502020-05-19T10:20:26Z<p>Juliette Leportois: </p>
<hr />
<div>The French Supreme Administrative Court (Conseil d'Etat "CE") ruled that the processing of personal data of persons in psychiatric care without their consent for the prevention of terrorist radicalization does not fall within the GDPR scope. <br />
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |CE - N° 431350<br />
|-<br />
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:Conseil_D'Etat_photo.png|center|150px|link=Special:FilePath/Conseil_D'Etat_photo.png]]<br />
|-<br />
|Court:||[[:Category:CE (France)|CE (France)]]<br />
[[Category:CE (France)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in France|France]]<br />
[[Category:France]]<br />
|-<br />
|Relevant Law:||[[Category:Article 2(2) GDPR|Article 2 GDPR#2]]<br />
[[Article 2 GDPR#2a|Article 2(2)(a) GDPR]]<br />
|-<br />
|Decided:||27. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||CRPA, LDH and MGEN ASS Vs. French Republic<br />
|-<br />
|National Case number:||N° 431350<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:FR:CECHR:2020:431350.20200327</small><br />
|-<br />
|Appeal from:||CE acting as the first and last instance<br />
|-<br />
|Language:||French<br />
[[Category:French]]<br />
|-<br />
|Original Source:||[https://www.legifrance.gouv.fr/affichJuriAdmin.do?oldAction=rechJuriAdmin&idTexte=CETATEXT000041785967&fastReqId=662954110&fastPos=1 Légifrance(in FR)]<br />
|}<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, ''inter alia'', the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority.<br />
<br />
The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law.<br />
<br />
The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR.<br />
<br />
===Dispute===<br />
The Court had to assess which legal was applicable and whether the further processing is lawful.<br />
<br />
===Holding===<br />
<br />
The Supreme Administrative Court decided<br />
<br />
First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté)<br />
<br />
Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment<br />
<br />
Fourthly, the Court ruled that personal data related to health are lawfully processed for public interests.<br />
<br />
Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected.<br />
<br />
Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure.<br />
<br />
As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.<br />
<br />
==Comment==<br />
''Share your comment on the decision here!'' <br />
<br />
==Further Resources==<br />
''Share other blogs or news articles here!''<br />
<br />
See the CNIL's summary and comments [https://www.cnil.fr/fr/droit-au-dereferencement-le-conseil-detat-tire-les-consequences-des-arrets-de-la-cour-de-justice-de here]. <br />
<br />
==English Machine Translation of the Decision==<br />
<br />
<pre><br />
References<br />
Council of State<br />
<br />
N° 431350 <br />
ECLI:EN:CECHR:2020:431350.20200327<br />
Mentioned in the tables of the Lebon collection<br />
10th - 9th bedrooms combined<br />
Mrs Isabelle Lemesle, Rapporteur<br />
Mr Alexandre Lallet, public rapporteur<br />
<br />
<br />
reading of Friday 27 March 2020<br />
FRENCH REPUBLIC<br />
<br />
ON BEHALF OF THE FRENCH PEOPLE<br />
<br />
<br />
Full text<br />
Having regard to the following procedures:<br />
<br />
1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State:<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State :<br />
<br />
1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State :<br />
<br />
1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State :<br />
<br />
1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018;<br />
<br />
3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling;<br />
<br />
4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to :<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
....................................................................................<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
In view of the other parts of the files ;<br />
<br />
Seen:<br />
- the European Convention for the Protection of Human Rights and Fundamental Freedoms;<br />
- the Charter of Fundamental Rights of the European Union;<br />
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ;<br />
- the Public Health Code ;<br />
- the Internal Security Code ;<br />
- Law No. 78-17 of 6 January 1978;<br />
- the code of administrative justice;<br />
<br />
<br />
After hearing in public session:<br />
<br />
- the report of Mrs. Isabelle Lemesle, State Councillor;<br />
<br />
- the conclusions of Mr. Alexandre Lallet, Maître des requêtes;<br />
<br />
The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians;<br />
Considering the following:<br />
<br />
1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision.<br />
<br />
On the conclusions directed against the decree of 23 May 2018:<br />
<br />
2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)".<br />
<br />
3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible.<br />
<br />
On the conclusions directed against the decree of 6 May 2019:<br />
<br />
4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed.<br />
<br />
With regard to the admissibility of applications :<br />
<br />
5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree.<br />
<br />
6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree.<br />
<br />
As regards the intervention of UNAFAM :<br />
<br />
7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350.<br />
<br />
As regards the legality of the contested decree :<br />
<br />
8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted.<br />
<br />
9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016.<br />
<br />
11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded.<br />
<br />
12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed.<br />
<br />
13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree.<br />
<br />
14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him".<br />
<br />
15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed.<br />
<br />
16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative.<br />
<br />
17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed.<br />
<br />
18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions.<br />
<br />
19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits.<br />
<br />
20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter.<br />
<br />
21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings.<br />
<br />
<br />
<br />
<br />
D E C I D E :<br />
--------------<br />
Article 1: The intervention of UNAFAM is admitted.<br />
Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected.<br />
<br />
Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health.<br />
Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10250APD/GBA (Belgium) - 17/20202020-05-18T11:13:02Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 12(3) GDPR<br />
|GDPR_Article_Link_1=Article 12 GDPR#3<br />
|GDPR_Article_2=Article 15(1) GDPR<br />
|GDPR_Article_Link_2=Article 15 GDPR#1<br />
|GDPR_Article_3=Article 15(3) GDPR<br />
|GDPR_Article_Link_3=Article 15 GDPR#3<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered to two access requests under Article 15 GDPR. <br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019. <br />
<br />
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
<br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
===Dispute===<br />
The authority has to clarify the scope of application of Article 15 GDPR. <br />
<br />
===Holding===<br />
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR. <br />
<br />
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.<br />
<br />
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.<br />
<br />
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR<br />
<br />
==Comment==<br />
<br />
''share your comment here!''<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10249APD/GBA (Belgium) - 17/20202020-05-18T11:11:06Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 12(3) GDPR<br />
|GDPR_Article_Link_1=Article 12(3) GDPR<br />
|GDPR_Article_2=Article 15(1) GDPR<br />
|GDPR_Article_Link_2=Article 15(1) GDPR<br />
|GDPR_Article_3=Article 15(3) GDPR<br />
|GDPR_Article_Link_3=Article 15(3) GDPR<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered to two access requests under Article 15 GDPR. <br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019. <br />
<br />
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
<br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
===Dispute===<br />
The authority has to clarify the scope of application of Article 15 GDPR. <br />
<br />
===Holding===<br />
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR. <br />
<br />
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.<br />
<br />
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.<br />
<br />
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR<br />
<br />
==Comment==<br />
<br />
''share your comment here!''<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10248APD/GBA (Belgium) - 17/20202020-05-18T11:09:58Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 15 GDPR<br />
|GDPR_Article_Link_1=Article 15 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered to two access requests under Article 15 GDPR. <br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019. <br />
<br />
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
<br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
===Dispute===<br />
The authority has to clarify the scope of application of Article 15 GDPR. <br />
<br />
===Holding===<br />
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR. <br />
<br />
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.<br />
<br />
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.<br />
<br />
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR<br />
<br />
==Comment==<br />
<br />
''share your comment here!''<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10247APD/GBA (Belgium) - 17/20202020-05-18T11:06:29Z<p>Juliette Leportois: /* English Summary */</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 15 GDPR<br />
|GDPR_Article_Link_1=Article 15 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
TO BE COMPLETED. <br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019. <br />
<br />
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
<br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
===Dispute===<br />
The authority has to clarify the scope of application of Article 15 GDPR. <br />
<br />
===Holding===<br />
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR. <br />
<br />
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.<br />
<br />
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.<br />
<br />
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR<br />
<br />
==Comment==<br />
<br />
''share your comment here!''<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10230APD/GBA (Belgium) - 17/20202020-05-14T16:19:33Z<p>Juliette Leportois: /* English Machine Translation of the Decision */</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 15 GDPR<br />
|GDPR_Article_Link_1=Article 15 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
TO BE COMPLETED. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsel, requesting “a copy of all the personal data you hold as well as any additional information you have against them asking”. In response, the Defendant asked them to provide for their ID card and to specify which right they wanted to exercise. As the complainant found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019.<br />
The complainants argued that the Defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
<br />
<br />
=== Dispute ===<br />
The authority has to discuss on the interplay between the GDPR and the specific legal framework applicable to the banking sector. <br />
<br />
=== Holding ===<br />
The authority ruled that the data subject who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Thus, if necessary the authority can change the legal basis. <br />
The authority also ruled that the request for exercise of a GDPR right, such as the access right, implies that the authority exercise on the basis of objective law and does not concern only the subjective rights of the parties. <br />
<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
<br />
Litigation Chamber <br />
<br />
Substantive Decision 17/2020 of 28 April 2020 <br />
<br />
<br />
File No.: DOS-2019-05450 <br />
<br />
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. <br />
<br />
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; <br />
<br />
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; <br />
<br />
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); <br />
<br />
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); <br />
<br />
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the <br />
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; <br />
<br />
Having regard to the documents on file; <br />
<br />
Has taken the following decision concerning: - the complainants <br />
<br />
- the defendant (controller) <br />
<br />
1. History of the procedure <br />
<br />
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; <br />
<br />
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. <br />
<br />
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ; <br />
<br />
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. <br />
<br />
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. <br />
<br />
6. Having regard to the submissions of the defendant, received on 21 February 2020 ; <br />
<br />
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ; <br />
<br />
8. Having regard to the form of order sought by the defendant, received on 20 March 2020. <br />
<br />
2. The facts and subject-matter of the complaint <br />
<br />
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay <br />
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. <br />
<br />
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process <br />
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ... <br />
<br />
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1. <br />
<br />
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data. <br />
<br />
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. <br />
<br />
3. The conclusions exchanged following the complaint <br />
<br />
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. <br />
<br />
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. <br />
<br />
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof. <br />
<br />
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new <br />
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data. <br />
<br />
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future. <br />
<br />
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. <br />
<br />
<br />
<br />
4. On the grounds of the decision <br />
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions <br />
<br />
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. <br />
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive"). <br />
<br />
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law. <br />
<br />
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). <br />
<br />
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD. <br />
<br />
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. <br />
<br />
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data. <br />
<br />
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). <br />
<br />
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control. <br />
<br />
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. <br />
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. <br />
<br />
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. <br />
<br />
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. <br />
a fortiori insofar as the decisions of the Litigation Chamber are likely to be <br />
full appeal to the Market Court . <br />
<br />
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law. <br />
<br />
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. <br />
<br />
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers <br />
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation. <br />
<br />
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. <br />
<br />
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint. <br />
<br />
<br />
On the merits of the request under section 15 of the GDPR <br />
<br />
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": <br />
- the purposes of the processing, <br />
- the categories of personal data concerned, <br />
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...], <br />
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ; <br />
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data <br />
(b) the right to object to the processing of personal data relating to the data subject; <br />
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; <br />
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. » <br />
<br />
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). <br />
<br />
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". <br />
prescribed procedure for responding to an access request. <br />
<br />
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory. <br />
<br />
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis. <br />
<br />
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. <br />
<br />
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. <br />
access, [...]"). <br />
<br />
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR. <br />
<br />
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. <br />
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act). <br />
<br />
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. <br />
<br />
<br />
<br />
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request. <br />
<br />
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). <br />
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information. <br />
<br />
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: <br />
<br />
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR). <br />
<br />
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. <br />
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR. <br />
<br />
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access. <br />
<br />
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient <br />
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". <br />
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request. <br />
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". <br />
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. <br />
<br />
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt. <br />
<br />
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). <br />
<br />
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. <br />
<br />
The completeness or otherwise of the reply to the request for access <br />
<br />
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. <br />
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship. <br />
<br />
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD. <br />
<br />
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR. <br />
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank. <br />
<br />
63. Thus, the document does not provide any information on : <br />
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; <br />
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); <br />
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; <br />
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; <br />
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); <br />
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. <br />
15 § 2 RGPD). <br />
<br />
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The <br />
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. <br />
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. <br />
<br />
On corrective measures and sanctions <br />
<br />
<br />
66. Under article 100 of the LCA, the Litigation Chamber has the power to : <br />
<br />
"1° dismiss the complaint without further action; <br />
2° order the dismissal; <br />
3° pronounce a suspension of the pronouncement; <br />
4° propose a settlement; <br />
5° issue warnings or reprimands; <br />
6° order to comply with the requests of the person concerned to exercise these rights; <br />
7° order that the person concerned be informed of the security problem; <br />
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; <br />
(9) order that the treatment be brought into conformity; <br />
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; <br />
11° order the withdrawal of the approval of certification bodies; <br />
(12° give penalty payments; <br />
13° give administrative fines; <br />
14° order the suspension of transborder data flows to another State or international organization; <br />
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; <br />
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. » <br />
<br />
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. <br />
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. » <br />
<br />
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. <br />
<br />
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. <br />
<br />
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. <br />
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant. <br />
<br />
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: <br />
<br />
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: <br />
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. <br />
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. » <br />
<br />
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). <br />
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it. <br />
<br />
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. <br />
<br />
<br />
ON THESE GROUNDS, <br />
<br />
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : <br />
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; <br />
<br />
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant; <br />
<br />
<br />
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. <br />
<br />
<br />
Hielke Hijmans <br />
President of the Litigation Chamber <br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10229APD/GBA (Belgium) - 17/20202020-05-14T16:18:52Z<p>Juliette Leportois: Replaced content with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=DOS-2019-05450 |..."</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 15 GDPR<br />
|GDPR_Article_Link_1=Article 15 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
TO BE COMPLETED. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsel, requesting “a copy of all the personal data you hold as well as any additional information you have against them asking”. In response, the Defendant asked them to provide for their ID card and to specify which right they wanted to exercise. As the complainant found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019.<br />
The complainants argued that the Defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card. <br />
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act. <br />
<br />
<br />
=== Dispute ===<br />
The authority has to discuss on the interplay between the GDPR and the specific legal framework applicable to the banking sector. <br />
<br />
=== Holding ===<br />
The authority ruled that the data subject who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Thus, if necessary the authority can change the legal basis. <br />
The authority also ruled that the request for exercise of a GDPR right, such as the access right, implies that the authority exercise on the basis of objective law and does not concern only the subjective rights of the parties. <br />
<br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10227APD/GBA (Belgium) - 17/20202020-05-13T15:51:38Z<p>Juliette Leportois: /* English Machine Translation of the Decision */</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Partly Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 5(1)(a) GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR#1a<br />
|GDPR_Article_2=Article 6(1)(f) GDPR<br />
|GDPR_Article_Link_2=Article 6 GDPR#1f<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that an employer who collected orally personal information relating to a former employee and further shared to a third party for the purpose of legal defense, breached the GDPR. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The complainant has been dismissed in December 2017 and April 2018 by the two defendants who are thus, former employers. In April 2018, the Complainant and his Union challenged the first dismissal and further exchanged with the first employers regarding the dismissal. The second employer initiated a proceeding against him to retrieve documents, over the same period in 2018. <br />
The complainants learned through his Union that the second employer gave personal information linked to the undergoing litigation to the first employer. The first employer further shared the same information to the Union. <br />
Thus, the Complaint filed a complaint with the Belgian data protection authority claiming that the second employer unlawfully transmitted personal data to the first employer who unlawfully collected and further shared that information with a third party, the Union. <br />
<br />
=== Dispute ===<br />
The Authority had to discuss whether the two processing at stake fallen into the scope of the GDPR and then, if there were unlawful. <br />
<br />
=== Holding ===<br />
Concerning the second employer, the authority ruled that personal information linked to the litigation was not a processing within the meaning of Article 2(1) GDPR. Indeed, the first employer never had access to the ruling which was issued shortly before the two employers talked about the complainant only orally. Thus, there is neither an automated processing system, nor a filing system. As a consequence, the first part of the complaint was rejected. <br />
Concerning the first employer, the authority ruled that the information collected from the second employer was unlawfully processed under Aticle 6(1)(f) GDPR, and thus, the controller breached the principle of fairness under Article 5(1)(a) GDPR. <br />
First, the authority pointed out that the information linked to the civil litigation does not fall under Article 10 GDPR which only applies to criminal convictions and offences. <br />
Secondly, the authority recalled that the processing is lawful under Article 6(1)(f) GDPR to the extent that the pursuit of a legitimate interest by the controller (a), the necessity of the processing for the fulfilment of the legitimate interest pursued (b) and the condition that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued (c), are cumulative -.<br />
The authority acknowledged that the interest invoked by the controller, namely his legal defense, was legitimate. However, it also ruled that the necessity and proportionally criteria were not fulfilled. Indeed, the authority highlighted that it would be excessive and disproportional to accept that all previous employers can exchange any information relating to an employee, for their legal defense. Thus the sharing of information to the Union was unlawful. <br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
Chambre Contentieuse <br />
<br />
Décision 03/2020 du 21 février 2020 <br />
<br />
<br />
<br />
N° de dossier : DOS-2018-05326 <br />
<br />
Objet : Plainte de Monsieur X à l’encontre deux anciens employeurs <br />
<br />
La Chambre Contentieuse de l'Autorité de protection des données, constituée de Monsieur Hielke <br />
Hijmans, président, et de Messieurs Romain Robert et Christophe Boeraeve, membres ; <br />
<br />
Vu le Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la Directive 95/46/CE (Règlement Général sur la Protection des Données), ci-après RGPD; <br />
<br />
Vu la Loi du 3 décembre 2017 portant création de l'Autorité de protection des données (ci-après LCA); <br />
<br />
Vu le règlement d'ordre intérieur de l’Autorité de protection des données tel qu'approuvé par la <br />
Chambre des représentants le 20 décembre 2018 et publié au Moniteur belge le 15 janvier 2019 ; <br />
<br />
Vu les pièces du dossier ; <br />
<br />
A pris la décision suivante concernant : <br />
- le plaignant <br />
<br />
- le responsable de traitement 1 (ci-après le premier défendeur) <br />
- le responsable de traitement 2 (ci-après le second défendeur) <br />
<br />
I. Rétroactes de la procédure <br />
Vu la plainte déposée le 30 septembre 2018 par le plaignant auprès de l’Autorité de protection des données ; <br />
<br />
Vu la décision du 15 octobre 2018 du Service de première ligne de l’Autorité de protection des données déclarant la plainte recevable et la transmission de celle-ci à la Chambre Contentieuse à cette même date ; <br />
<br />
Vu la décision prise par la Chambre Contentieuse lors de sa séance du 23 octobre 2018 de considérer que le dossier était prêt pour traitement quant au fond en vertu des articles 95 § 1er, 1° et 98 LCA ; <br />
<br />
Vu le courrier daté du 30 octobre 2018 de la Chambre Contentieuse informant les parties de sa décision précitée de considérer le dossier comme étant prêt pour traitement au fond sur la base de l’article 98 LCA ; <br />
<br />
Vu l’invitation du 29 novembre 2018 adressée par la Chambre Contentieuse aux parties les invitant à faire valoir leurs arguments selon un calendrier établi ; <br />
<br />
Vu les modifications apportées au calendrier initial par décisions de la Chambre Contentieuse du 9 janvier 2019, du 30 avril 2019 et du 12 juin 2019; <br />
<br />
Vu les conclusions en réponse du premier défendeur déposées par ses conseils, reçues le 28 janvier 2019 ; <br />
<br />
Vu la demande formulée par le premier défendeur aux termes de ces conclusions d’être, à l’issue de l’échange de conclusions, entendu par la Chambre Contentieuse en application de l’article 51 du Règlement d’ordre intérieur de l’Autorité de protection des données; <br />
<br />
Vu les conclusions du plaignant reçues par la Chambre Contentieuse le 27 mars 2019 ; <br />
<br />
Vu la demande formulée par le plaignant dans ses conclusions d’être entendu par la Chambre Contentieuse à l’issue de l’échange des conclusions en application de l’article 51 du Règlement d’ordre intérieur de l’Autorité de protection des données; <br />
<br />
Vu les conclusions déposées par le second défendeur représenté par ses conseils, reçues par la Chambre Contentieuse le 26 avril 2019 ; <br />
<br />
Vu les conclusions en réplique du premier défendeur déposées par ses conseils, reçues le 3 mai 2019 ; <br />
2<br />
<br />
Vu l’octroi par la Chambre Contentieuse d’un dernier délai pour conclure adressé à toutes les parties en date du 12 juin 2019 ; <br />
<br />
Vu les invitations à l’audition adressées par la Chambre Contentieuse en dates du 20 décembre 2019 et du 15 janvier 2020 ; <br />
<br />
Vu l’audition lors de la séance de la Chambre Contentieuse du 28 janvier 2020 au cours de laquelle seul le plaignant était présent ; <br />
<br />
Vu le procès-verbal d’audition du 28 janvier 2020 et les annotations du plaignant du 4 février 2020 qui y ont été jointes et communiquées aux premier et second défendeurs le 11 février 2020. <br />
<br />
<br />
II. Les faits et l’objet de la plainte <br />
<br />
La plainte introduite par le plaignant s’inscrit dans le contexte d’un conflit qui l’oppose à son ancien employeur, le premier défendeur ainsi qu’à un second ancien employeur, le deuxième défendeur. <br />
<br />
Le premier défendeur – qui regroupe plusieurs médecins généralistes - a engagé le plaignant le 24 août 2016 en qualité d’assistant marketing et communication. Le plaignant a été licencié par le premier défendeur moyennant l’exécution d’un préavis à prester de deux mois par courrier recommandé du 2 octobre 2017. <br />
<br />
Le premier défendeur produit dans le cadre de la présente procédure un certain nombre de courriers adressés au plaignant desquels il ressort que, selon le premier défendeur, ce dernier n’exécutait pas les prestations demandées pendant la période de préavis, soit au cours des mois de novembre et de décembre 2017. Dans son courrier recommandé adressé au plaignant le 10 janvier 2018, le premier défendeur considère que le plaignant a manqué à ses obligations professionnelles en ne prestant pas l’entièreté du travail convenu et décide dès lors, pour le mois de décembre 2017, de le déclarer en congé sans solde sans droit à rémunération. <br />
<br />
A la suite de ce courrier, le plaignant a saisi son organisation syndicale. Celle-ci indique au plaignant avoir adressé une mise en demeure au premier défendeur en date du 11 avril 2018. Un échange de lettres s’en est suivi entre le syndicat et le premier défendeur, dont le courrier - objet du litige porté devant la Chambre Contentieuse - du 14 juin 2018 adressé par le premier défendeur au syndicat. <br />
<br />
3<br />
Il ressort des pièces déposées dans le cadre de la procédure que, par ce courrier du 14 juin 2018, le premier défendeur écrit au syndicat notamment ce qui suit (extrait) : <br />
« Depuis, son nouvel employeur – le second défendeur - , nous a contacté pour nous faire part de son attitude comparable à celle qu’il avait au sein de notre société, c’est-à-dire qu’il ne s’est plus présenté sur son lieu de travail après un certain temps et n’a plus rendu compte de ses prestations. La société a dû lui remettre son préavis après 2 mois. <br />
<br />
D’après mes informations, un litige s’est récemment déroulé entre votre affilié et son nouvel employeur au cours duquel il aurait utilisé des faux arguments et agit à l’encontre du règlement de la société. <br />
<br />
Le tribunal l’a condamné à payer des dommages et intérêts pour ces faits». <br />
Après avoir été licencié par le premier défendeur, le plaignant a travaillé de janvier à avril 2018 pour le second défendeur. Il a été licencié par le second défendeur quelques mois après avoir débuté auprès de cette société, soit en avril 2018. Il ressort du jugement prononcé par le Tribunal de première instance de Bruxelles siégeant en référé produit dans le cadre de la présente procédure que le second défendeur a engagé une procédure en référé par citation à l’encontre du plaignant pour récupérer des fichiers auprès de lui. C’est à cette décision – avec mention erronée de sa date – que le premier défendeur fait allusion dans son courrier du 14 juin adressé au syndicat. <br />
<br />
Ce courrier du 14 juin est la réponse du premier défendeur au courrier que lui a adressé le syndicat le 23 mai 2018. <br />
<br />
Dans ce courrier du 23 mai, le syndicat conteste les motifs du licenciement du plaignant (qualifiant le licenciement de manifestement déraisonnable) et réclame notamment, outre le paiement des prestations effectuées pendant son préavis par le plaignant : <br />
<br />
- Une indemnité correspondant à 17 semaines de rémunération conformément à l’article 9 de la Convention collective n° 109 du 12 février 2014 concernant la motivation du licenciement <br />
(absence de motif de licenciement) ; <br />
La plainte déposée par le plaignant auprès de l’Autorité de protection des données comporte deux volets : <br />
Premier volet à l’encontre du second défendeur <br />
Le plaignant reproche au second défendeur d’avoir communiqué au premier défendeur des informations relatives à l’exécution de son travail auprès de ce dernier ainsi que des informations relatives à la procédure judiciaire l’opposant au second défendeur pour récupération de documents appartenant à cette société à l’issue de leur relation contractuelle (décision du Tribunal de première instance de Bruxelles siégeant en référé). <br />
4<br />
<br />
Second volet à l’encontre du premier défendeur <br />
Le plaignant reproche en outre au premier défendeur d’avoir collecté ces mêmes informations auprès du second défendeur et de les avoir, par courrier du 14 juin 2018, communiqué à son syndicat. <br />
<br />
Le plaignant demande à l’Autorité de protection des données de déclarer sa plainte fondée et de considérer les sanctions appropriées aux actes qui ont été posés et aux dommages qui en ont suivi. <br />
<br />
III. L’audition du 28 janvier 2020 <br />
Lors de son audition du 28 janvier 2020, le plaignant a rappelé les faits et contesté plusieurs éléments mis en avant par le premier défendeur dans ses conclusions en se référant à ses propres conclusions. Il a ajouté les éléments suivants : <br />
- Sa lecture des conclusions du premier défendeur révèle que des contacts préalables à celui au terme duquel le second défendeur a communiqué au premier défendeur les informations litigieuses relatives à sa condamnation en justice ont eu lieu à son sujet entre les défendeurs ; <br />
- La nature de droit fondamental du droit à la protection des données ; <br />
- Le non-respect du principe de proportionnalité et de minimisation dans le chef des défendeurs lors de la communication de données le concernant et l’absence de pertinence des données communiquées au regard de la problématique d’absence de délivrance de l’original de son formulaire C4 (certificat de chômage) et de la nature du licenciement dont il avait fait l’objet de la part du second défendeur ; <br />
- L’absence de respect du principe de loyauté à son égard lors de cette même communication de données le concernant ; <br />
- L’absence de base de licéité admissible, l’intérêt légitime prépondérant dans le chef des défendeurs tel qu’invoqué ne pouvant selon lui être retenu ; <br />
- Une atteinte à son droit à l’oubli ainsi qu’à son droit d’opposition fut-ce celui-ci d’application ; <br />
- L’absence de consentement dans son chef à la communication de données à caractère personnel le concernant entre les défendeurs. <br />
- Les difficultés rencontrées pour obtenir son C4 (certificat de chômage) et le fait que celui-ci a été établi avant les contacts noués entre les défendeurs. <br />
<br />
IV. Quant à la compétence de l’APD, en particulier de la Chambre Contentieuse <br />
Quant à la compétence de l’Autorité de protection des données, en particulier de la Chambre Contentieuse <br />
<br />
En application de l’article 4 § 1er de la LCA, l'Autorité de protection des données (APD) est responsable du contrôle du respect des principes fondamentaux de la protection des données à caractère personnel <br />
5<br />
contenus dans le RGPD et dans d’autres lois contenant des dispositions relatives à la protection du traitement des données à caractère personnel. <br />
<br />
En application de l’article 33 § 1er de la LCA, la Chambre Contentieuse est l’organe de contentieux administratif de l’APD. Elle est saisie des plaintes que le Service de première ligne lui transmet en application de l’article 62 § 1er LCA, soit des plaintes recevables dès lors que conformément à l’article 60 alinéa 2 LCA, ces plaintes sont rédigées dans l'une des langues nationales, contiennent un exposé des faits et les indications nécessaires pour identifier le traitement de données à caractère personnel sur lequel elles portent et relèvent de la compétence de l'Autorité de protection des données. <br />
<br />
Des traitements de données sont opérés dans de multiples secteurs d’activité, notamment dans le cadre des relations de travail contractuelles et post-contractuelles comme dans le cas d’espèce. Il n’en demeure pas moins que la compétence de l’Autorité de protection des données en général, et de la Chambre Contentieuse en particulier, est limitée au contrôle du respect de la règlementation applicable aux traitements de données, quel que soit le secteur d’activité dans lequel ces traitements de données interviennent. Son rôle n’est pas de se substituer aux juridictions du travail dans l’exercice des compétences qui sont les leurs en matière de droit du travail notamment. <br />
<br />
L’article 2 § 1 du RGPD définit le champ d’application matériel du RGPD comme suit: <br />
« Le présent règlement s’applique au traitement de données à caractère personnel automatisé en tout ou en partie, ainsi qu’au traitement non automatisé de données à caractère personnel contenues ou appelées à figurer dans un fichier ». <br />
<br />
Quant à la communication d’informations par le second défendeur au premier défendeur (volet 1 de la plainte), les défendeurs indiquent tous deux aux termes de leurs conclusions que cet échange d’information a bien eu lieu mais uniquement de manière orale. <br />
<br />
Dans ses conclusions, le premier défendeur précise à cet égard : <br />
« Avoir en effet eu un contact avec l’employeur suivant du plaignant qui mettra un terme à son contrat de travail quelques mois plus tard le 6 avril 2018 (cette information, relève du dossier de la présente procédure). <br />
<br />
Visiblement, les relations professionnelles entre le plaignant et son nouvel employeur sont conflictuelles comme le plaignant l’explique dans sa plainte en l’espèce. <br />
<br />
6<br />
La démarche du premier défendeur, dans sa relation avec le deuxième défendeur, était essentiellement de comprendre la manière la plus optimale de réagir face aux plaintes du plaignant. (…) ». <br />
<br />
Aux termes de ses conclusions, le premier défendeur certifie qu’il n’a cependant eu accès à aucun jugement « puisque le jugement du … dont il est fait mention dans le courrier du 14 juin 2018 n’est même pas une donnée correcte dès lors que le plaignant affirme, dans sa plainte, que son jugement a été rendu le …, ce qui rend d’ailleurs plus malaisé une transmission de ce jugement entre les deux sociétés en cause, le même jour que celui de son prononcé par le tribunal d’une part, et de la rédaction, et l’envoi du courrier recommandé du 14 juin 2018 par le premier défendeur d’autre part ! ». <br />
<br />
Quant au second défendeur, il précise aux termes de ses conclusions dans le même sens : <br />
<br />
Traduction <br />
« 1.26. (…) En juin 2018, la Deputy Executive Director du second défendeur, a été contactée par le précédent employeur du plaignant. Celui-ci lui a demandé quelles étaient ses expériences avec le plaignant. De bonne foi et de manière assez informelle, le second défendeur a dépeint de manière générale ses expériences avec le plaignant. Et a notamment fait savoir que le contrat de travail avec le plaignant avait pris fin et qu’ils avaient dû engager une procédure en référé afin de pouvoir récupérer auprès du plaignant certaines propriétés de l'entreprise. Aucune information écrite n'a été fournie, et encore moins a fortiori la décision (!)." <br />
Plus loin au point 3.2. de ses conclusions, le second défendeur conclut que: <br />
<br />
Traduction <br />
"Tout d'abord, il ne s'agit pas dans ce cas d'un traitement automatisé de données à caractère personnel ou d'un traitement non-automatisé de données à caractère personnel qui sont reprises dans un fichier. En effet, le second défendeur a uniquement communiqué verbalement et par téléphone des informations générales à l'ancien employeur du plaignant, à la demande de ce dernier. Dès lors, (…) et le Règlement général sur la protection des données ne sont, à titre principal, pas d’application”. <br />
<br />
7<br />
Il ne résulte par ailleurs pas des pièces du dossier déposées par le plaignant que cette communication aurait eu lieu de manière automatisée par le second défendeur. <br />
<br />
En conclusion, la communication par le second défendeur de l’information selon laquelle le plaignant avait fait l’objet d’une condamnation par les cours et tribunaux n’est pas constitutive, dans le chef du second défendeur, d’un traitement automatisé de données ni d’un traitement manuel de données appelées à figurer dans un fichier au sens de l’article 2 du RGPD. <br />
<br />
La Chambre Contentieuse de l’Autorité de protection des données n’est donc pas compétente à l’égard de ces faits. La plainte dans son volet dirigé à l’encontre du second défendeur est non-fondée. <br />
<br />
V. Sur les motifs de la décision <br />
Sur le manquement à l’obligation de licéité par le premier défendeur (volet 2 de la plainte) <br />
<br />
En sa qualité de responsable de traitement, le premier défendeur est tenu de respecter les principes de protection des données et doit être en mesure de démontrer que ceux-ci sont respectés (principe de responsabilité – article 5.2. du RGPD) et de mettre en œuvre toutes les mesures nécessaires à cet effet (article 24 du RGPD). <br />
<br />
En application de l’article 5 § 1 a) du RGPD, tout traitement de données à caractère personnel, fut-il totalement ou partiellement automatisé, doit notamment être loyal et licite. Pour être licite, tout traitement de donnée à caractère personnel doit notamment trouver un fondement à l’article 6 du RGPD. Il appartient au responsable de traitement de déterminer quel est ce fondement. <br />
<br />
En l’espèce, la collecte d’informations auprès du second défendeur et la communication par courrier du 14 juin 2018 du premier défendeur au syndicat de l’information des difficultés rencontrées dans la relation de travail avec le plaignant ainsi que l’information selon laquelle le plaignant a fait l’objet d’une décision judiciaire sont des traitements de données à caractère personnel soumis à l’application du RGPD. Ils doivent s’appuyer sur l’une des base de licéité listées à l’article 6 du RGPD. <br />
<br />
Quant à la nature des données traitées, la Chambre Contentieuse rappelle que l’article 10 du RGPD concerne le traitement des seules données personnelles liées aux condamnations pénales et aux infractions ou aux mesure de sûreté connexe. L’article 10 du RGPD ne peut être étendu aux sanctions administratives ou jugements civils. Le champ d’application de cette disposition est réduit et la marge <br />
8<br />
de manœuvre contenue dans la Directive 95/46/CE relative à la protection des personnes physiques <br />
à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données (article 8 § 5 alinéa 2) pour élargir la notion de « données judiciaires » n’existe plus. <br />
<br />
L’information selon laquelle le plaignant a été condamné par décision du Tribunal de première instance de Bruxelles ne constitue donc pas une donnée « judiciaire » au sens de l’article 10 du RGPD. Il n’en demeure pas moins que par nature, les informations relatives à des condamnations en justice telle que des données judiciaires à caractère civil comme en l’espèce, revêtent une sensibilité certaine. <br />
<br />
L’inexactitude de cette donnée (soit la date du jugement mentionnée au premier défendeur par le second défendeur, laquelle n’était pas la date exacte du jugement) ne lui fait cependant pas perdre sa qualification de donnée à caractère personnel. L’objet du jugement et le contexte dans lequel il s’inscrit sont autant de données à caractère personnel relatives au plaignant fut-ce la date du jugement inexacte. Cette même inexactitude, fut-elle imputable au second défendeur et non au premier défendeur, n’est pas non plus de nature à supprimer la matérialité des faits comme l’invoque le premier défendeur. <br />
<br />
Quant à licéité du traitement (article 5 § 1 a) du RGPD), le premier défendeur indique qu’il se fonde sur l’article 6 § 1 f) du RGPD aux termes duquel le traitement de données est licite « si, et dans la <br />
mesure où, il est nécessaire aux fins des intérêts légitimes poursuivis par le responsable du traitement ou par un tiers, à moins que ne prévalent les intérêts ou les libertés et droits fondamentaux de la personne concernée qui exigent une protection des données à caractère personnel, notamment lorsque la personne concernée est un enfant ». <br />
<br />
Le premier défendeur expose que dans le contexte litigieux existant entre lui-même et le syndicat du plaignant, eu égard aux menaces d’enclencher une action en justice à son encontre formulées par le syndicat et compte tenu de la nécessité de faire valoir sa défense, le premier défendeur a recueilli et communiqué l’information litigieuse au syndicat. <br />
<br />
Le plaignant estime quant à lui qu’aucun motif ne permet de légitimer la prise de contact opérée par les défendeurs entre – eux, en particulier par le premier défendeur auprès du second défendeur, ni la communication des informations le concernant à son organisation syndicale. <br />
<br />
La Chambre Contentieuse relève que le point f) de l’article 6 du RGPD renvoie à un intérêt légitime poursuivi par le responsable du traitement (a). Le traitement des données à caractère personnel doit être «nécessaire à la réalisation de l’intérêt légitime» poursuivi par le responsable du traitement (b). <br />
9<br />
Enfin, le recours à l’intérêt légitime est expressément subordonné à un critère supplémentaire de mise en balance, qui vise à protéger l’intérêt et les droits et libertés fondamentaux des personnes concernées. En d’autres termes, l’intérêt légitime poursuivi par le responsable du traitement doit être comparé avec l’intérêt ou les droits et libertés fondamentaux de la personne concernée, l’objectif de la mise en balance étant de prévenir une incidence disproportionnée sur ces droits et libertés. L’intérêt poursuivi par le responsable de traitement, fut-il légitime et nécessaire, ne peut valablement être invoqué que si les droits et libertés fondamentaux des personnes concernées ne prévalent pas sur cet intérêt. La Cour de Justice de l’Union européenne a précisé que ces trois conditions – soit la poursuite d’un intérêt légitime par le responsable de traitement (a), la nécessité du traitement pour la réalisation de l’intérêt légitime poursuivi (b) et la condition que les droits et libertés fondamentaux des personnes concernées ne prévalent pas sur l’intérêt poursuivi (c), sont cumulatives . <br />
<br />
Si c’est au responsable du traitement des données qu’il revient initialement d’apprécier si les conditions énoncées à l’article 6 § 1 (en ce compris donc le litera f)) du RGPD sont satisfaites, la légitimité du traitement peut ensuite faire l’objet d’une autre évaluation, et éventuellement être contestée, entre autres par les personnes concernées et par les autorités chargées du contrôle de la protection des données. Un examen au cas par cas, tenant compte des circonstances concrètes de chaque plainte, permettra ainsi à la Chambre Contentieuse de l’APD de conclure quant à la licité de traitements fondés sur la base de l’intérêt légitime invoqué, comme en l’espèce, par le responsable de traitement. <br />
<br />
Le traitement des données à caractère personnel doit être «nécessaire à la réalisation de l’intérêt légitime» poursuivi par le responsable du traitement. Cette condition de nécessité entre le traitement opéré et l’intérêt légitime poursuivi est particulièrement pertinente dans le cas de l’article 6 § 1 f) du RGPD afin de garantir que le traitement des données fondé sur l’intérêt légitime ne débouche pas sur une interprétation trop large de l’intérêt à traiter des données. <br />
<br />
Dans ce contexte, la Chambre Contentieuse est d’avis que l’utilisation de moyens de défense s’appuyant sur des données résultant d’une collecte directe de données auprès de la personne concernée doit, pour satisfaire le principe de loyauté, être privilégiée. <br />
<br />
Le premier défendeur invoque pour intérêt légitime sa défense à l’égard des griefs qui lui étaient opposés par l’organisation syndicale représentant le plaignant. La Chambre Contentieuse estime qu’en l’espèce, cette défense participe de la « défense en justice », soit d’un droit fondamental consacré à l’article 48 de la Charte des droits fondamentaux de l’Union. De manière générale, la « défense en <br />
10<br />
justice » peut effectivement être considérée comme un intérêt légitime licite dans le contexte de l’application de l’article 6 § 1 f) du RGPD. Conformément à l’Avis 06/2014 du Groupe de l’Article 29 sur la notion d’intérêt légitime , cet intérêt doit être réel et présent, soit non hypothétique. <br />
<br />
La Chambre Contentieuse constate que cet intérêt constituait au moment des faits un intérêt légitime réel et présent. En effet, lors de la prise de contact entre le premier défendeur et le second défendeur en juin 2018, le premier défendeur s’était vu adresser plusieurs courriers déjà depuis avril 2018, notamment le courrier du 23 mai 2018 de la part du syndicat le mettant en cause comme cela a été relaté ci-dessus dans l’exposé des faits. <br />
<br />
Néanmoins, pour que cet intérêt légitime de « défense en justice » du premier défendeur prévale, le traitement des données doit être «nécessaire» et «proportionné» à l’exercice de cette défense en justice. Il serait excessif et contraire à ces exigences de nécessité et de proportionnalité d’admettre que tous les précédents employeurs d’un employé puissent, de par cette qualité, échanger toute information relative à un employé, fut-ce pour des besoins de défense en justice. <br />
<br />
A cet égard, la Chambre Contentieuse, sur la base des pièces du dossier, constate que le premier défendeur a licencié le plaignant et formulé les motifs de ce licenciement avant tout échange avec le second défendeur. Dans sa lettre du 14 juin 2018 au syndicat, le premier défendeur écrit avoir notifié les motifs de licenciement du plaignant à ce dernier en date du 21 décembre 2018. Ledit courrier du <br />
21 décembre 2018 est par ailleurs produit. Lors de son audition, le plaignant a indiqué que son C4 (certificat de chômage) transmis à l’Office National de l’Emploi (ONEM) avait lui aussi été rédigé avant cette prise de contact. <br />
<br />
En d’autres termes, les motifs du licenciement du plaignant dont le premier défendeur pouvait légitimement se prévaloir à l’égard du syndicat sont indépendants et antérieurs à toute information que le second défendeur a pu ou aurait pu apporter. En effet, c’est au moment du licenciement, de l’information du plaignant quant à ses motifs ainsi que de l’établissement du C4 qu’il appartenait au premier défendeur d’identifier les motifs du licenciement. Et c’est au regard de ceux-ci que le premier défendeur pouvait légitimement se défendre, le syndicat qualifiant le licenciement intervenu de manifestement déraisonnable. <br />
<br />
11<br />
La « défense en justice » ne peut légitimer la collecte et d’autres traitements subséquents tels la diffusion ou la communication à des tiers de toute donnée relative à la personne concernée. Ces traitements de données doivent, pour être nécessaires et proportionnés, s’inscrire de manière pertinente et proportionnée dans la finalité précisément identifiée de cet intérêt légitime, soit sa défense en justice à l’égard du litige concerné. <br />
<br />
En l’espèce, les informations traitées par le premier défendeur sont en réalité venues compléter les moyens de défense dont disposait déjà le premier défendeur à l’égard du licenciement du plaignant et ce, sans avoir de lien de pertinence avec celui-ci. Les motifs de licenciement sur lesquels le premier défendeur s’était appuyé pour licencier le plaignant et délivrer son C4 étant au cœur du litige avec le syndicat, d’autres données personnelles étrangères à ces motifs étaient sans pertinence, et a fortiori non nécessaires en l’espèce, pour sa défense sur cet aspect vis-à-vis du syndicat. <br />
<br />
La Chambre Contentieuse conclut au regard de ce qui précède que le premier défendeur ne pouvait fonder les traitements de données visés par la plainte sur son intérêt légitime à défaut pour ces traitements d’être nécessaires et proportionnés au sens de l’article 6 § 1 f) du RGPD. En l’absence de base de licéité, la Chambre Contentieuse conclut que l’article 5 § 1 a) du RGPD combiné à l’article 6 du RGPD n’ont pas été respectés en l’espèce. <br />
<br />
La Chambre Contentieuse constate également que le premier défendeur n’a pas respecté le principe de loyauté également consacré à l’article 5 § 1 a) du RGPD en traitant des informations disproportionnées et non pertinentes - puisque, comme exposé ci-dessus, sans lien avec les motifs sur lesquels elle avait fondé le licenciement du plaignant - obtenues auprès de tiers à l’insu délibéré du plaignant. <br />
<br />
VI. Sur les mesures correctrices et les sanctions <br />
Aux termes de l’article 100 LCA, la Chambre Contentieuse a le pouvoir de : <br />
1° classer la plainte sans suite ; <br />
2° ordonner le non-lieu ; <br />
3° prononcer une suspension du prononcé ; <br />
4° proposer une transaction ; <br />
5° formuler des avertissements ou des réprimandes ; <br />
6° ordonner de se conformer aux demandes de la personne concernée d'exercer ces droits; <br />
7° ordonner que l'intéressé soit informé du problème de sécurité; <br />
8° ordonner le gel, la limitation ou l'interdiction temporaire ou définitive du traitement; <br />
9° ordonner une mise en conformité du traitement; <br />
10° ordonner la rectification, la restriction ou l'effacement des données et la notification de celles-ci aux récipiendaires des données; <br />
12<br />
11° ordonner le retrait de l'agréation des organismes de certification; <br />
12° donner des astreintes; <br />
13° donner des amendes administratives; <br />
14° ordonner la suspension des flux transfrontières de données vers un autre Etat ou un organisme international; <br />
15° transmettre le dossier au parquet du Procureur du Roi de Bruxelles, qui l'informe des suites données au dossier; <br />
16° décider au cas par cas de publier ses décisions sur le site internet de l'Autorité de protection des données. <br />
<br />
Les principes de licéité et de loyauté consacrés à l’article 5 § 1 a) du RGPD sont des principes fondateurs de l’encadrement de la protection des données. Leur respect est essentiel. L’exigence d’une base de licéité - laquelle fait défaut en l’espèce - en fait partie. <br />
<br />
Quant à la nature des données à caractère personnel traitées, la Chambre Contentieuse a déjà rappelé qu’il y a notamment eu traitement de données judiciaires à caractère civil. Ces données ne sont pas visées par l’article 10 du RGPD mais elles n’en revêtent pas moins une sensibilité certaine. <br />
<br />
Quant à la manière dont les données à caractère personnel ont été traitées, la Chambre Contentieuse constate que les données litigieuses ont été initialement collectées oralement et rendues accessibles par un courrier unique, à un destinataire unique, le syndicat, lequel représentait le plaignant lui-même. La Chambre Contentieuse relève également que le personnel du syndicat est, outre le fait que le syndicat est lui-même tenu de respecter les obligations découlant du RGPD, soumis à une obligation de confidentialité propre. <br />
<br />
La Chambre Contentieuse relève également la nature ponctuelle des dits traitements et l’absence de violation pertinente commise précédemment par le premier défendeur. <br />
<br />
En conclusion, au regard de l’ensemble des éléments développés ci-dessus propres à cette affaire, la Chambre Contentieuse estime que les faits constatés et le manquement aux articles 5 § 1 a) et 6 du <br />
RGPD, justifient qu’au titre de sanction effective, proportionnée et dissuasive telle que prévue à l’article 83 du RGPD une réprimande (article 100 § 1er, 5° LCA) soit prononcée à l’encontre du premier défendeur. <br />
<br />
Compte tenu de l'importance de la transparence en ce qui concerne le processus décisionnel et les décisions de la Chambre Contentieuse, cette décision sera publiée sur le site Internet de l'Autorité de protection des données moyennant la suppression des données d’identification directe des parties et des personnes citées, qu’elles soient physiques ou morales. <br />
13<br />
<br />
PAR CES MOTIFS, <br />
<br />
La Chambre Contentieuse de l'Autorité de protection des données décide, après délibération : <br />
<br />
- de déclarer la plainte non-fondée à l’égard du second défendeur ; <br />
<br />
- de prononcer à l’encontre du premier défendeur une réprimande sur la base de l’article 100 § 1er, 5° LCA ; <br />
En vertu de l’article 108, § 1 LCA, cette décision peut faire l’objet d’un recours auprès de la Cour des marchés dans un délai de 30 jours à compter de sa notification, avec l'Autorité de protection des données en tant que défenderesse. <br />
<br />
<br />
<br />
Hielke Hijmans <br />
Président de la Chambre Contentieuse <br />
14<br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&diff=10226APD/GBA (Belgium) - 17/20202020-05-13T15:47:05Z<p>Juliette Leportois: Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=DOS-2019-05450 |ECLI..."</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Belgium<br />
|DPA-BG-Color=<br />
|DPAlogo=LogoBE.png<br />
|DPA_Abbrevation=APD/GBA<br />
|DPA_With_Country=APD/GBA (Belgium)<br />
<br />
|Case_Number_Name=DOS-2019-05450<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=APD/GBA<br />
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf<br />
|Original_Source_Language_1=French<br />
|Original_Source_Language__Code_1=FR<br />
<br />
|Type=Complaint<br />
|Outcome=Partly Upheld<br />
|Date_Decided=<br />
|Date_Published=<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 5(1)(a) GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR#1a<br />
|GDPR_Article_2=Article 6(1)(f) GDPR<br />
|GDPR_Article_Link_2=Article 6 GDPR#1f<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=n/a<br />
|<br />
}}<br />
<br />
The Belgian data protection authority (APD/GBA) ruled that an employer who collected orally personal information relating to a former employee and further shared to a third party for the purpose of legal defense, breached the GDPR. <br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The complainant has been dismissed in December 2017 and April 2018 by the two defendants who are thus, former employers. In April 2018, the Complainant and his Union challenged the first dismissal and further exchanged with the first employers regarding the dismissal. The second employer initiated a proceeding against him to retrieve documents, over the same period in 2018. <br />
The complainants learned through his Union that the second employer gave personal information linked to the undergoing litigation to the first employer. The first employer further shared the same information to the Union. <br />
Thus, the Complaint filed a complaint with the Belgian data protection authority claiming that the second employer unlawfully transmitted personal data to the first employer who unlawfully collected and further shared that information with a third party, the Union. <br />
<br />
=== Dispute ===<br />
The Authority had to discuss whether the two processing at stake fallen into the scope of the GDPR and then, if there were unlawful. <br />
<br />
=== Holding ===<br />
Concerning the second employer, the authority ruled that personal information linked to the litigation was not a processing within the meaning of Article 2(1) GDPR. Indeed, the first employer never had access to the ruling which was issued shortly before the two employers talked about the complainant only orally. Thus, there is neither an automated processing system, nor a filing system. As a consequence, the first part of the complaint was rejected. <br />
Concerning the first employer, the authority ruled that the information collected from the second employer was unlawfully processed under Aticle 6(1)(f) GDPR, and thus, the controller breached the principle of fairness under Article 5(1)(a) GDPR. <br />
First, the authority pointed out that the information linked to the civil litigation does not fall under Article 10 GDPR which only applies to criminal convictions and offences. <br />
Secondly, the authority recalled that the processing is lawful under Article 6(1)(f) GDPR to the extent that the pursuit of a legitimate interest by the controller (a), the necessity of the processing for the fulfilment of the legitimate interest pursued (b) and the condition that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued (c), are cumulative -.<br />
The authority acknowledged that the interest invoked by the controller, namely his legal defense, was legitimate. However, it also ruled that the necessity and proportionally criteria were not fulfilled. Indeed, the authority highlighted that it would be excessive and disproportional to accept that all previous employers can exchange any information relating to an employee, for their legal defense. Thus the sharing of information to the Union was unlawful. <br />
<br />
== Comment ==<br />
<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the French original. Please refer to the French original for more details.<br />
<br />
<pre><br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=ICO_-_FS50848833&diff=10215ICO - FS508488332020-05-12T16:23:17Z<p>Juliette Leportois: </p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=United Kingdom<br />
|DPA-BG-Color=background-color:#023868;<br />
|DPAlogo=LogoUK.png<br />
|DPA_Abbrevation=ICO<br />
|DPA_With_Country=ICO (UK)<br />
<br />
|Case_Number_Name=FS50848833<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=ICO<br />
|Original_Source_Link_1=https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617689/fs50848833.pdf <br />
|Original_Source_Language_1=English<br />
|Original_Source_Language__Code_1=EN<br />
<br />
|Type=Complaint<br />
|Outcome=Rejected<br />
|Date_Decided=<br />
|Date_Published=01.05.2020<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 5 GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR<br />
|GDPR_Article_2=Article 6 GDPR<br />
|GDPR_Article_Link_2=Article 6 GDPR<br />
|GDPR_Article_3=Article 9 GDPR<br />
|GDPR_Article_Link_3=Article 9 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=Unknown<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=Mariam TABATADZE<br />
|<br />
}}<br />
The ICO issued a decision stating the DfE acted lawfully by refusing to provide the entire audio record of the 'Trojan Horse affaire' hearing. The requested information includes special category data and its disclosure would breach data protection principles.<br />
==English Summary==<br />
===Facts===<br />
The Department of Education (the DfE) was requested to provide the entire audio recording of a Professional Conduct Panel hearing into a case against five teachers - so called Trojan Horse affair. (This involved investigations into the alleged infiltration of Islamist extremists into the education sector in Birmingham. These hearings investigate whether there has been unacceptable professional misconduct by these five teachers) The hearing took place in public and was recorded by the National College for Teaching and Leadership (NCTL). The panel’s decision was announced on the government’s website. The complainant argued with the DfE that the audio files contain important information not found elsewhere such as how statements were spoken including intonation and emotion. He further argues that this is essential for public scrutiny and transparency in this case. The request was refused by the DfE under section 40(2) (personal information), 31(2) (law enforcement) and 14 (vexatious request) of the FOIA. Section 40 of the FOIA provides exemptions from the right to information if it is personal data as defined in the DPA. Section 31 provides exemption from disclosure for certainness categories of information to protect the law enforcement investigations. Section 14 states that the public authorities do not have to comply with vexatious requests. The complainant filed a complaint against the DfE with the ICO about the way his request for information had been handled by the DfE.<br />
===Dispute===<br />
The ICO had to determine whether the DfE has correctly withheld information within the scope of the request on the basis of section 14 of the FOIA or either of the exemptions at section 40(2) or 31(2) of the FOIA. First, the ICO had to assess if the requested information imposes the burden upon the DfE. Second, the ICO analyzes if the withheld information includes personal data and if the disclosure of that data will contravene the DP principles.<br />
===Holding===<br />
The ICO starts its ruling by stating that complying with the present request would not be a burden for the DfE, and moved on to consider if the requested information constituted personal data as defined by the Data Protection Act 2018 (‘DPA’). By referring to section 3(2) of the DPA, the ICO stated that the withheld information in the audio record falls within the definition of ‘personal data’, it relates to and identifies the data subjects concerned. Audio recording would reveal the identities of individuals involved and would capture information related to religious views due to the hearing relating to alleged extremism. Moreover, the requested data does include special category data. Here, the commissioner refers to article 9 of the GDPR. ‘There will be clear references to the religious beliefs of some of the individuals’ and it would be difficult to separate out the special category data without rendering some of the remaining information meaningless, particularly as the request concerns audio recordings. As none of the conditions required by article 9 of GDPR for processing special category data are satisfied there is no legal basis for its disclosure. Processing any special category data in the recordings would therefore breach principle of DP and so this information is exempt under section 40(2) of the FOIA. The ICO has gone on to consider if there are conditions defined by an article 6 of GDPR (in this case art.6 (1)(f)) to allow for the lawful processing of the remaining personal data in the audio recordings that is not special category data. The ICO considered three-part test: Legitimate interest Necessity and Balancing tests. While the ICO acknowledges that the disclosure of the requested information is necessary to meet the legitimate interests identified by the complainant, it determined that that legitimate interest is insufficient to outweigh the data subjects’ fundamental rights and freedoms.<br />
==Comment==<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the English original. Please refer to the English original for more details.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=ICO_-_FS50848833&diff=10214ICO - FS508488332020-05-12T16:23:06Z<p>Juliette Leportois: Created page with "{{DPAdecisionBOX |Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO |DPA_With_Country=ICO (UK) |Case_Number_Name=F..."</p>
<hr />
<div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=United Kingdom<br />
|DPA-BG-Color=background-color:#023868;<br />
|DPAlogo=LogoUK.png<br />
|DPA_Abbrevation=ICO<br />
|DPA_With_Country=ICO (UK)<br />
<br />
|Case_Number_Name=FS50848833<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=ICO<br />
|Original_Source_Link_1=https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617689/fs50848833.pdf <br />
|Original_Source_Language_1=English<br />
|Original_Source_Language__Code_1=EN<br />
<br />
|Type=Complaint<br />
|Outcome=Rejected<br />
|Date_Decided=<br />
|Date_Published=01.05.2020<br />
|Year=<br />
|Fine=None<br />
|Currency=<br />
<br />
|GDPR_Article_1=Article 5 GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR<br />
|GDPR_Article_2=Article 6 GDPR<br />
|GDPR_Article_Link_2=Article 6 GDPR<br />
|GDPR_Article_3=Article 9 GDPR<br />
|GDPR_Article_Link_3=Article 9 GDPR<br />
<br />
<br />
<br />
|Party_Name_1=<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
|Party_Name_4=<br />
|Party_Link_4=<br />
|Party_Name_5=<br />
|Party_Link_5=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=Unknown<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=Mariam TABATADZE<br />
|<br />
}}the ICO issued a decision stating the DfE acted lawfully by refusing to provide the entire audio record of the 'Trojan Horse affaire' hearing. The requested information includes special category data and its disclosure would breach data protection principles.<br />
==English Summary==<br />
===Facts===<br />
The Department of Education (the DfE) was requested to provide the entire audio recording of a Professional Conduct Panel hearing into a case against five teachers - so called Trojan Horse affair. (This involved investigations into the alleged infiltration of Islamist extremists into the education sector in Birmingham. These hearings investigate whether there has been unacceptable professional misconduct by these five teachers) The hearing took place in public and was recorded by the National College for Teaching and Leadership (NCTL). The panel’s decision was announced on the government’s website. The complainant argued with the DfE that the audio files contain important information not found elsewhere such as how statements were spoken including intonation and emotion. He further argues that this is essential for public scrutiny and transparency in this case. The request was refused by the DfE under section 40(2) (personal information), 31(2) (law enforcement) and 14 (vexatious request) of the FOIA. Section 40 of the FOIA provides exemptions from the right to information if it is personal data as defined in the DPA. Section 31 provides exemption from disclosure for certainness categories of information to protect the law enforcement investigations. Section 14 states that the public authorities do not have to comply with vexatious requests. The complainant filed a complaint against the DfE with the ICO about the way his request for information had been handled by the DfE.<br />
===Dispute===<br />
The ICO had to determine whether the DfE has correctly withheld information within the scope of the request on the basis of section 14 of the FOIA or either of the exemptions at section 40(2) or 31(2) of the FOIA. First, the ICO had to assess if the requested information imposes the burden upon the DfE. Second, the ICO analyzes if the withheld information includes personal data and if the disclosure of that data will contravene the DP principles.<br />
===Holding===<br />
The ICO starts its ruling by stating that complying with the present request would not be a burden for the DfE, and moved on to consider if the requested information constituted personal data as defined by the Data Protection Act 2018 (‘DPA’). By referring to section 3(2) of the DPA, the ICO stated that the withheld information in the audio record falls within the definition of ‘personal data’, it relates to and identifies the data subjects concerned. Audio recording would reveal the identities of individuals involved and would capture information related to religious views due to the hearing relating to alleged extremism. Moreover, the requested data does include special category data. Here, the commissioner refers to article 9 of the GDPR. ‘There will be clear references to the religious beliefs of some of the individuals’ and it would be difficult to separate out the special category data without rendering some of the remaining information meaningless, particularly as the request concerns audio recordings. As none of the conditions required by article 9 of GDPR for processing special category data are satisfied there is no legal basis for its disclosure. Processing any special category data in the recordings would therefore breach principle of DP and so this information is exempt under section 40(2) of the FOIA. The ICO has gone on to consider if there are conditions defined by an article 6 of GDPR (in this case art.6 (1)(f)) to allow for the lawful processing of the remaining personal data in the audio recordings that is not special category data. The ICO considered three-part test: Legitimate interest Necessity and Balancing tests. While the ICO acknowledges that the disclosure of the requested information is necessary to meet the legitimate interests identified by the complainant, it determined that that legitimate interest is insufficient to outweigh the data subjects’ fundamental rights and freedoms.<br />
==Comment==<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the English original. Please refer to the English original for more details.</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_M%C3%BCnchen_%E2%80%93_11_ZB_19.991&diff=10206VGH München – 11 ZB 19.9912020-05-11T15:10:43Z<p>Juliette Leportois: /* English Machine Translation of the Decision */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |G München – 11 ZB 19.991<br />
|-<br />
| colspan="2" style="padding: 20px;" |[[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG München (Germany)|VG München (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG München (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1d|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] <br />
[[Category:Article 6(1)(f) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(d) GDPR]] <br />
[[Category:Article 23(1)(d) GDPR]]<br />
|-<br />
|Decided:||09.03.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||Unknoww vs investigating police in administrative offence proceedings<br />
|-<br />
|National Case Number:||11 ZB 19.991<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||Administrative Court Regensburg, Ruling from 17.04.2019 - RN 3 K 19.267<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[https://www.gesetze-bayern.de/(X(1)S(pvybcknyf1nkuq0d5uk4rd35))/Content/Document/Y-300-Z-BECKRS-B-2020-N-4488?hl=true&AspxAutoDetectCookieSupport=1 Bayern.Recht (DE)]<br />
|}<br />
<br />
The Administrative Court of Munich ruled by order that the transfer of personal dates of the responsible driver to the police is permissible in accordance with Art. 6 (1) subparagraph 1 letter f GDPR. After weighing up the interests of the driver and the police authority, the court decided that the transfer of personal data was in the public interest, as the police had the task of preventing, investigating, detecting or prosecuting criminal offences in accordance with Art. 23 (1) lit. d GDPR. The procedure was also compatible with the principle of purpose limitation within the meaning of Article 5 para. 1 lit. b GDPR.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
<br />
===Dispute===<br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
===Holding===<br />
The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out).<br />
<br />
According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. <br />
<br />
The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.<br />
<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>VGH Munich, decision of 09.03.2020 - 11 ZB 19.991<br />
Titles:<br />
Isolated legal aid application - Logbook<br />
Standard chains:<br />
VwGO § 166 para. 1 p. 1<br />
ZPO § 114 para. 1 p. 1, § 121 para. 1<br />
StVZO § 31a paragraph 1 p. 1, paragraph 3<br />
Regulation (EU) 2016/679 Art. 5 para. 1 lit. d, Art. 6 para. 1 subpara. 1 lit. f, Art. 23 para. 1 lit. d<br />
guiding principles:<br />
1 If an intended application for legal protection is settled before lis pendens and the possible filing of an action for a declaration of continuation is also out of the question, there is no longer any room for legal aid and an isolated legal aid application remains unsuccessful. In this respect, the relevant point in time for assessment is not the point in time when the application for legal aid is mature enough to be granted, but the point in time of the court's decision on the legal aid application. (marginal 12) (editorial motto)<br />
(2) According to the consistent case law of the higher courts, notification of a traffic violation committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, within the scope of what is possible and reasonable, in identifying the responsible driver; this also applies if he is not obliged to name the driver, for example because he has the right to refuse to give evidence or testify (see BayVGH BeckRS 2019, 8672 marginal no. 16 mwN). The order to keep a logbook does not presuppose either unlawful conduct or fault on the part of the vehicle owner in the non-detectability of the driver. (marginal 19) (editorial motto)<br />
3) According to Art. 6 para. 1 subpara. 1 lit. f of the Basic Data Protection Regulation (DSGVO), the disclosure of personal data of the responsible driver to the police is permissible when weighed against the interests of the driver in order to safeguard the legitimate interest of the police authority in fulfilling the tasks incumbent upon it in the public interest, which according to Art. 23 para. 1 lit. d DSGVO include the prevention, investigation, detection or prosecution of criminal offences including administrative offences. If data is stored in connection with driving a vehicle, the transmission authorisation is also compatible with the principle of purpose limitation as defined in Article 5(1)(b) DPA. (marginal no. 20) (editorial guiding principle)<br />
Buzzwords:<br />
isolated legal aid application, driver's logbook, execution of the intended legal protection request, relevant time of assessment, obligation of the vehicle owner to cooperate, right to give evidence or refuse to give evidence, illegal behaviour, fault, basic data protection regulation, authority to transmit, fulfilment of official tasks, principle of purpose limitation<br />
Lower court:<br />
VG Regensburg, judgment of 17.04.2019 - RN 3 K 19.267<br />
Place where it was found:<br />
BeckRS 2020, 4488<br />
<br />
Tenor<br />
The application for legal aid is rejected.<br />
Reasons<br />
I.<br />
1<br />
The applicant seeks legal aid in respect of the proposed application for leave to appeal, which concerns an action against a driver's logbook.<br />
2<br />
On 10 September 2018, the motor vehicle ... * ... ... registered in the name of the plaintiff ... * ... on the A3 federal motorway at a speed of 116 km/h was only 20 m away and thus less than 4/10 of half the speedometer value (58 m). The photograph taken by the police showed a woman driving the vehicle.<br />
3<br />
A witness questionnaire dated October 31, 2018, sent to the plaintiff for completion, was not returned. During a telephone interview with the plaintiff by the police on November 22, 2018, he stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
4<br />
The preliminary proceedings were discontinued by order dated 10 December 2018.<br />
5<br />
During the hearing on an intended logbook requirement, the plaintiff submitted in a letter dated 21 January 2019 that the vehicles registered on him had an electronic logbook. In accordance with the EU Data Protection Basic Regulation, employee data may only be disclosed to third parties with express written consent, even in the case of administrative offenses. New employment contracts already provide for this provision. In the case of old contracts, this approval must be obtained in each case. For employees who are no longer employed by the company, this is sometimes difficult.<br />
6<br />
By decision dated February 11, 2019, the Freyung-Grafenau District Office, based on § 31a, Subsection 1, Sentence 1, StVZO, ordered the plaintiff to keep a logbook for the vehicle with the registration number ... * ... ... and any replacement vehicle for a period of twelve months and obligated him to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after the time for which it is to be kept.<br />
7<br />
The plaintiff challenged this decision at the Regensburg Administrative Court on February 18, 2019. At the same time, he applied for interim relief. By order dated March 15, 2019 (RN 3 p. 19,266), the Administrative Court rejected the urgent application. After waiving an oral hearing, it also dismissed the action. The reasons for the ruling state that the requirements of § 31a StVZO are fulfilled. The plaintiff's vehicle had committed a significant traffic offence which, according to No. 3.2.3 of Annex 13 to the FeV, No. 12.6 of the catalogue of fines and No. 12.6.2 of Table 2 of the Annex to the catalogue of fines, would have been punishable by entry of a point in the register of fitness to drive and a fine of EUR 100. It had not been possible to identify the driver of the vehicle within the limitation period. It is true that the plaintiff, as the vehicle owner, had not been informed within two weeks of the traffic offence being committed. However, this was harmless if the exceeding of the time frame had not been the cause of the impossibility of identifying the driver, e.g. if the owner did not name the driver although he could clearly remember him, if a photo sufficient for identification had been presented to him or if the offence had been committed with a company vehicle in a business context. This had been the case here. The investigating authority could regularly dispense with time-consuming, hardly promising further clarification measures if the vehicle owner was recognisably unwilling to cooperate in the clarification of the traffic offence. The Basic Data Protection Regulation (DSGVO) is probably not directly applicable to police investigations, or at least data processing is justified according to the requirements of this Regulation even without the consent of the person concerned. The exception to the scope of application (Article 2.2(d) DPA) also covered administrative offences. In addition, data collection from the plaintiff would also be subject to the provisions of Article 6.1(e) DSGVO in conjunction with Article 6.1(b) DSGVO. Article 2, 28.2 no. 2 BayDSG without the consent of the data subject, since the processing in the context of the administrative offence proceedings is necessary for the performance of a task which is in the public interest or is carried out in the exercise of official authority which has been assigned to the person responsible. If the DSGVO had been applicable, the plaintiff would have been entitled to a licence under Article 6.1 letter. c DSGVO, the plaintiff would have been entitled to surrender the personal data even without the consent of the person concerned, as this would have been necessary to fulfil his legal obligation to cooperate in identifying the vehicle owner. He had not been able to invoke the DSGVO against the investigating police. Nor did the DSGVO preclude the preventive maintenance of a logbook. The ordered duration of twelve months was not disproportionate in view of the fact that it was a company vehicle which could be used to a considerable extent by several persons.<br />
8<br />
On 14 May 2019, the applicant lodged an 'appeal' and, at the same time, applied for 'procedural assistance' in that regard. Due to an accident at work and the resulting reduced ability to work, he was unable to pay the costs of the proceedings on his own. The requirements of sec. 24 para. 1 no. 1 BDSG were not fulfilled and no other legal basis was relevant. Thus, a transfer of data to the prosecution authority was inadmissible. Since this provision only provides for the permissibility of the transfer, but not for an obligation to do so, and since the police authority, unlike the public prosecutor's office, for example, is not legally obliged to transfer data, it had to be waived for the time being. Even if there were an obligation to transfer personal data to the prosecution authorities, Article 6.1.1 (1) of the Basic Law would also be applicable in addition to § 24 of the Federal Data Protection Act. c DSGVO would also apply. If a data transfer had been possible under the DSGVO, the information pursuant to Article 13.3 DSGVO would have had to be provided to the data subject first. Neither the police nor the criminal prosecution authorities could explain any threat to the investigative measures or state a legal basis on the basis of which the prior information of the data subjects could have been dispensed with. In view of the complexity of the matter and the lack of a trend-setting judiciary on this subject, he was to be granted procedural assistance.<br />
9<br />
The defendant replied that the application for legal aid for the intended admission procedure should be rejected. For the applicant was wrong in his assumption that there was no authority or right to transmit the name of the driver to the Police Administration Office for the purpose of prosecuting an administrative offence. It is true that the DSGVO applies to the transmission of driver data to the police administration office if it is assumed that the administrative offence was actually committed in the course of the business use of the vehicle. In this case, Article 2.2(2)(b) of the DSGVO was applicable. c DSGVO was not relevant here. Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by the competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of sentences and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, does not apply, since no data processing by an authority is involved in this data transfer to an authority (Article 1(1) of Directive (EU) 2016/680, Paragraph 45 sentence 1 of the Federal Data Protection Act). The authority to transmit follows from Article 6.1, second subparagraph, letter f of the DPA, according to which for a private individual (cf. Article 6.1, second subparagraph, DSGVO e contrario) the processing, i.e. also the transmission (cf. Article 4, no. 2, DSGVO), is permissible in order to safeguard the legitimate interests of a third party, unless the interests of the data subject, in this case the driver of the vehicle, outweigh those of the data subject. Third parties were legal persons or authorities (cf. Art. 4 No. 10 DSGVO), including the police administration office investigating the case. It was obvious that authorities had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest. Tasks in the public interest were in particular the tasks referred to in Article 23.1 letter d of the DPA (see Article 23.1 letter e of the DPA, which refers to other important objectives in the public interest), and hence also the prosecution of criminal offences. Criminal offences within the meaning of Article 23.1 letter d of the DPA are - as the court of first instance correctly pointed out in another context on page 10 of the grounds for the judgment - also administrative offences. The weighing up of interests was at the expense of the driver of the vehicle, since nobody was granted an overriding interest in being spared prosecution for a criminal offence or administrative offence. Article 6.1(1)(e) DSGVO was not relevant. Private individuals could only invoke this provision if the power to access personal data had been conferred on them in the public interest or as an exercise of official authority. They must therefore - which is not the case here - act in place of an authority. The applicability of Article 6.1(1)(f) of the DPA could not be countered by the argument that the duty of a witness to give evidence did not exist vis-à-vis the police administration office or the police, but only before a court (§ 48.1 of the DPA). 1 sentence 2 StPO in conjunction with § 46.1 OWiG), before the public prosecutor's office (§ 161a StPO in conjunction with § 46.1 OWiG) and in the case of an underlying summons from the public prosecutor's office (§ 163.3 StPO in conjunction with § 46.1 OWiG). The above-mentioned duties to provide information are sector-specific regulations ("more specific provisions") within the meaning of Article 6 paragraph 2 DSGVO, which as implementing provisions are subject to Article 6 paragraph 1, subparagraph 1, letter. c DSGVO as implementing provisions. However, the standards only regulated the more extensive obligations to provide information, not the previous level of the right to provide information which is at issue here. Nor does the power to transmit (the right to transmit) conflict with the principle of purpose limitation (Article 5(1)(b) of the DPA), since there is no other purpose. The purpose of the (mental or actual) data storage that took place in connection with driving the vehicle was the driving of the vehicle. This also included possible subsequent proceedings, such as the settlement of claims in connection with accidents or the settlement of official or judicial sanctions. However, even if one wanted to assume a change of purpose, this would in any case be the result of a compatibility check according to Art. 6 para. 4 Old Law. 3 DSGVO, because such data processing is in any case readily foreseeable by the data subject on the basis of the factual context (Art. 6 para. 4 letter b DSGVO) (Art. 6 para. 4 letter a DSGVO). Sec. 24.1 No. 1 of the Federal Data Protection Act mentioned by the plaintiff constituted an implementing provision within the meaning of Article 6.4 Old Law. 2 DSGVO, which enables additional national deviations from the purpose, the compatibility test under Article 6.4, old version, which is directly enshrined in the DSGVO. 3 DSGVO, which is directly enshrined in the DSGVO, and which must also remain unaffected in terms of competence law. No conclusion to the contrary could be drawn from § 24.1 no. 1 BDSG. The information duties cited by the plaintiff could not affect his authority to transmit from the outset. Moreover, such information duties would not have been triggered by the transmission. For the plaintiff, they were ruled out because there was no change of purpose pursuant to Art. 13 para. 3 DSGVO. For the police they would not exist according to Art. 28 para. 1 sentence 1 no. 1, para. 3 no. 2 BayDSG.<br />
10<br />
For further details, reference is made to the court files of both instances and to the administrative files submitted.<br />
II.<br />
11<br />
The application for legal aid for the admission procedure is unsuccessful.<br />
12<br />
Insofar as the main issue, such as the obligation to keep a logbook, has in the meantime been settled by the passage of time (cf. Art. 43 para. 2 BayVwVfG; BayVGH, B.v. 9.12.2013 - 11 ZB 13.1748 - juris marg. no. 12 f. ), there is no longer any room for legal aid, irrespective of whether or not an action should still be brought (see OVG NW, B.v. 12 January 2010 - 18 E 1195/09 - DÖV 2010, 572 = juris para. 3; NdsOVG, B.v. 6 November 2009 - 11 PA 290/09 - juris para. 3; OVG Berlin-Bbg, B.v. 12.1.2009 - 10 M 56.08 - juris nr. 3). Legal aid will in principle be granted for the future. If the intended application for legal aid is settled before the matter is pending, the isolated legal aid application will be unsuccessful (Wache in MK zur ZPO, 5th ed. 2016, § 114 marginal 102; Fischer in Musielak/Voit, ZPO, 16th ed. 2019, § 114 marginal 17; Bader in Bader/Funke-Kaiser/Stuhlfauth/von Albedyll, VwGO, 7th ed. 2018, § 166 marginal 32). In this respect, the relevant date of assessment is not that of the maturity for grant, but that of the court's decision on the application for legal aid, because costs for the intended and already completed legal action have not yet been incurred at all (see OVG NW, B.v. 12 January 2010 loc. cit. para. 7). Moreover, an application for legal aid for the filing of an action which has been settled in the main proceedings and is therefore inadmissible would be unfounded because the legal proceedings no longer offer sufficient prospects of success. The granting of legal aid for the possible filing of an action for a declaration of continuation is also out of the question here, because there are indications of the existence of an interest in a declaration of continuation, in particular from the recognised aspects of the risk of recurrence, the interest in rehabilitation or a far-reaching encroachment on fundamental rights by an administrative act, which is typically settled before the possibility of obtaining legal protection before the administrative court (see BVerfGE 101, 361 (2)). BVerwG, U.v. 16 May 2013 - 8 C 22.12 - Buchholz 310 § 113.1 VwGO no. 41 = juris margin no. 12 et seq.; BayVGH, B.v. 18 July 2016 - 11 ZB 16,299 - juris margin no. 15 et seq.<br />
13<br />
To the extent that the main proceedings, here with regard to the obligations to hand over and keep records, have not been resolved, the application for legal aid is unfounded because the intended application for admission does not promise a sufficient prospect of success (Paragraph 166(1), first sentence, of the VwGO in conjunction with Paragraph 114(1), first sentence, and Paragraph 121(1) of the ZPO). The plaintiff's economic need is therefore irrelevant.<br />
14<br />
Contrary to its wording, the Senate did not interpret the letter of 10 May 2019 from the applicant, who was not represented by a lawyer, as a lodging of an inadmissible appeal against the judgment of the Court of First Instance served on him on 14 April 2019, but as an application for legal aid in respect of an application for leave to appeal lodged by a lawyer. The applicant has not raised any objections to that interpretation. It is in his interest, because the lodging of the appeal would be inadmissible because it has not been admitted by the Administrative Court (§ 124.1, § 124a.4 VwGO) and the plaintiff could neither lodge nor apply for the appeal in person due to lack of the ability to postulate (see § 67.4 sentences 1 and 2 VwGO). If legal aid is granted, reinstatement in the period for appeal under § 124a.4 sentence 1 VwGO must in principle also be granted, since the risk of costs until a decision is reached on an application for legal aid which is in due time and form must regularly be recognised as an obstacle within the meaning of § 60.1 VwGO (Bier/Steinbeiß-Winkelmann in Schoch/Schneider/Bier, VwGO, as at July 2019, § 60 marginal nos. 17, 35).<br />
15<br />
For legal aid to be granted, it is usually sufficient that the prospects of success are open or that difficult legal questions which have not yet been clarified by the highest court are relevant to the decision (BVerfG, B.v. 13.3.1990 - 2 BvR 94/88 - BVerfGE 81, 347 = juris 2.) However, there are not sufficient prospects of success if success in the main action is not absolutely ruled out, but the chance of success is only a remote one, or if there are concrete and comprehensible indications that the taking of evidence will very probably be to the detriment of the applicant (cf. BVerfG, B.v. 20 February 2002 - 1 BvR 1450/00 - NJW-RR 2002, 1069 = juris nr. 12; B.v. 29 September 2004 - 1 BvR 1281/04 - NJW-RR 2005, 140 = juris nr. 14).<br />
16<br />
Measured against this, the requirements for the granting of legal aid are not met, since the reason for admission under Paragraph 124(2)(1) of the VwGO (serious doubts as to the correctness of the judgment) invoked by the applicant on the merits is not given and other reasons for admission are not apparent.<br />
17<br />
Pursuant to Section 31a (3) of the Straßenverkehrs-Zulassungs-Ordnung (StVZO) of 26 April 2012 (Federal Law Gazette I p. 679), as last amended by the Ordinance of 23 March 2017 (Federal Law Gazette I p. 522), the vehicle keeper shall, upon request, hand over the logbook for inspection at any time at the place specified by the issuing body to the person ordering the logbook or to the body or other persons designated by the issuing body, and shall keep the logbook for six months after expiry of the period for which it must be kept. These ancillary obligations share the legal fate of the driver's logbook, the order of which, pursuant to § 31a, para. 1, sentence 1 of the German Road Traffic Licensing Regulations (StVZO), requires that the identification of a driver was not possible after a violation of traffic regulations.<br />
18<br />
The Administrative Court was right to assume this. The plaintiff's vehicle constitutes a significant traffic offence (§ 4 Para. 1, § 49 Para. 1 No. 4 StVO, § 24 StVG, No. 3.2.3 of Annex 13 to the FeV in conjunction with § 1 BKatV in conjunction with No. 12.6 Annex to the BKatV (catalogue of fines), No. 12.6.2 of Table 2 of the Annex to the BKatV). The police were unable to identify the driver responsible within the limitation period, although their investigations were sufficient in view of the plaintiff's lack of cooperation.<br />
<br />
19<br />
As the defendant rightly pointed out, the issue in the present case was not whether the applicant was obliged to transfer the data of his former employee responsible for the traffic offence, but whether he was entitled to do so. According to the consistent case law of the higher courts, notification of a traffic violation committed with a vehicle justifies the obligation for its owner to cooperate in determining the responsible driver of the vehicle to the extent possible and reasonable (BayVGH, B. 3.5.2019 - 11 ZB 19.213 - juris marg. 16; SächsOVG, B.v. 10.1.2020 - 6 B 297/19 - juris marg. 3; OVG NW, B.v. 10.9.2019 - 8 B 774/19 - juris marg. 5; B.v. 15.5.2018 - 8 A 740/18 - DVBl 2018, 961 = juris para. 33; ThürOVG, B.v. 20.9.2018 - 2 EO 378/18 - VRS 134, 317 = juris para. 7). This also applies if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify (see BayVGH, loc.cit. m.w.N.). The order pursuant to § 31a para. 1 sentence 1 StVZO does not presuppose either that the vehicle owner behaves unlawfully or that he is at fault for the non-detectability of the driver (cf. NdsOVG, B.v. 14.1.2019 - 12 ME 170/18 - NJW 2019, 1013 = juris Rn. 17 with further details). With insufficient cooperation, he "merely" cuts off the objection that it would have been possible to identify the driver of the vehicle after the traffic violation if the prosecuting authority had continued its investigation (NdsOVG, loc.cit.).<br />
20<br />
It is also not in doubt that Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation - DSGVO; OJ L 119, 4.4.2009, p. 1) will not apply to the processing of personal data in the EU. 5.2016, p. 1) and the Federal Data Protection Act (BDSG) of 30 June 2017 (BGBl I p. 2097) did not preclude the transmission of driver data to the Police Administration Office, a data processing within the meaning of Article 4 No. 2 DSGVO. In this respect, reference can be made to the defendant's detailed reply of 12 June 2019, according to which - irrespective of the opening of the material scope of application of the DSGVO - a transfer of the personal data of the responsible driver to the police in accordance with Article 6 paragraph 1, second subparagraph, letter f DSGVO would have been permissible in any event in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 DSGVO, when weighed against the interests of the vehicle drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d DSGVO include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b DSGVO), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 DSGVO, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.<br />
21<br />
The decision is unappealable (§ 152 (1) VwGO).<br />
<br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_M%C3%BCnchen_%E2%80%93_11_ZB_19.991&diff=10205VGH München – 11 ZB 19.9912020-05-11T14:19:45Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |G München – 11 ZB 19.991<br />
|-<br />
| colspan="2" style="padding: 20px;" |[[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG München (Germany)|VG München (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG München (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1d|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] <br />
[[Category:Article 6(1)(f) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(d) GDPR]] <br />
[[Category:Article 23(1)(d) GDPR]]<br />
|-<br />
|Decided:||09.03.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||Unknoww vs investigating police in administrative offence proceedings<br />
|-<br />
|National Case Number:||11 ZB 19.991<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||Administrative Court Regensburg, Ruling from 17.04.2019 - RN 3 K 19.267<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[https://www.gesetze-bayern.de/(X(1)S(pvybcknyf1nkuq0d5uk4rd35))/Content/Document/Y-300-Z-BECKRS-B-2020-N-4488?hl=true&AspxAutoDetectCookieSupport=1 Bayern.Recht (DE)]<br />
|}<br />
<br />
The Administrative Court of Munich ruled by order that the transfer of personal dates of the responsible driver to the police is permissible in accordance with Art. 6 (1) subparagraph 1 letter f GDPR. After weighing up the interests of the driver and the police authority, the court decided that the transfer of personal data was in the public interest, as the police had the task of preventing, investigating, detecting or prosecuting criminal offences in accordance with Art. 23 (1) lit. d GDPR. The procedure was also compatible with the principle of purpose limitation within the meaning of Article 5 para. 1 lit. b GDPR.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
<br />
===Dispute===<br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
===Holding===<br />
The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out).<br />
<br />
According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. <br />
<br />
The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.<br />
<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_M%C3%BCnchen_%E2%80%93_11_ZB_19.991&diff=10204VGH München – 11 ZB 19.9912020-05-11T14:19:03Z<p>Juliette Leportois: /* English Summary */</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |G München – 11 ZB 19.991<br />
|-<br />
| colspan="2" style="padding: 20px;" |[[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG München (Germany)|VG München (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG München (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1d|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] <br />
[[Category:Article 6(1)(f) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(d) GDPR]] <br />
[[Category:Article 23(1)(d) GDPR]]<br />
|-<br />
|Decided:||09.03.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||Unknoww vs investigating police in administrative offence proceedings<br />
|-<br />
|National Case Number:||11 ZB 19.991<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||Administrative Court Regensburg, Ruling from 17.04.2019 - RN 3 K 19.267<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=30900 Bayern.Recht (DE)]<br />
|}<br />
<br />
The Administrative Court of Munich ruled by order that the transfer of personal dates of the responsible driver to the police is permissible in accordance with Art. 6 (1) subparagraph 1 letter f GDPR. After weighing up the interests of the driver and the police authority, the court decided that the transfer of personal data was in the public interest, as the police had the task of preventing, investigating, detecting or prosecuting criminal offences in accordance with Art. 23 (1) lit. d GDPR. The procedure was also compatible with the principle of purpose limitation within the meaning of Article 5 para. 1 lit. b GDPR.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
<br />
===Dispute===<br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
===Holding===<br />
The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out).<br />
<br />
According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. <br />
<br />
The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.<br />
<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_M%C3%BCnchen_%E2%80%93_11_ZB_19.991&diff=10203VGH München – 11 ZB 19.9912020-05-11T14:18:45Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |G München – 11 ZB 19.991<br />
|-<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG München (Germany)|VG München (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG München (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1d|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] <br />
[[Category:Article 6(1)(f) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(d) GDPR]] <br />
[[Category:Article 23(1)(d) GDPR]]<br />
|-<br />
|Decided:||09.03.2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||Unknoww vs investigating police in administrative offence proceedings <br />
|-<br />
|National Case Number:||11 ZB 19.991<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||Administrative Court Regensburg, Ruling from 17.04.2019 - RN 3 K 19.267 <br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=30900 Bayern.Recht (DE)]<br />
|}<br />
<br />
The Administrative Court of Munich ruled by order that the transfer of personal dates of the responsible driver to the police is permissible in accordance with Art. 6 (1) subparagraph 1 letter f GDPR. After weighing up the interests of the driver and the police authority, the court decided that the transfer of personal data was in the public interest, as the police had the task of preventing, investigating, detecting or prosecuting criminal offences in accordance with Art. 23 (1) lit. d GDPR. The procedure was also compatible with the principle of purpose limitation within the meaning of Article 5 para. 1 lit. b GDPR.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
<br />
===Dispute===<br />
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons.<br />
<br />
In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult.<br />
<br />
The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. <br />
<br />
<br />
===Holding===<br />
The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out).<br />
<br />
According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. <br />
<br />
The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.<br />
<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:VGH_Baden-W%C3%BCrttemberg_(Germany)&diff=10195Category:VGH Baden-Württemberg (Germany)2020-05-11T13:41:25Z<p>Juliette Leportois: </p>
<hr />
<div>Here you can find all decisions by the Administrative Court of Baden-Württemberg, Germany (''Verwaltungsgerichtshof - "VG"'').<br />
[[Category:German Court Decisions]]</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_Baden-W%C3%BCrttemberg_-_1_S_397/19&diff=10193VGH Baden-Württemberg - 1 S 397/192020-05-11T13:31:53Z<p>Juliette Leportois: Juliette Leportois moved page VGH Baden-Wüttemberg - 1 S 397/19 to VG Baden-Wüttemberg - 1 S 397/19 over redirect</p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VGH Baden-Wüttemberg - 1 S 397/19<br />
|-<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG Baden-Wüttemberg (Germany)|VG Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 16 GDPR#|Article 16 GDPR]] <br />
[[Category:Article 16 GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 17(1)(d) GDPR]] <br />
[[Category:Article 17(1)(d) GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 18(1)(a) GDPR]] <br />
[[Category:Article 18(1)(a) GDPR]]<br />
<br />
[[Article 18 GDPR#2|Article 18(2) GDPR]] <br />
[[Category:Article 18(2) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(c) GDPR]] <br />
[[Category:Article 23(1)(c) GDPR]]<br />
<br />
[[Article 23 GDPR#2|Article 23(2) GDPR]]<br />
[[Category:Article 23(2) GDPR]]<br />
<br />
[[Article 99 GDPR#|Article 99 GDPR]]<br />
[[Category:Article 99 GDPR]]<br />
<br />
[https://www.gesetze-im-internet.de/bmg/__12.html § 12 German Registration Law (Bundesmeldegesetz)]<br />
|-<br />
|Decided:||10. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||1 S 397/19<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||n/a<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=30900]<br />
|}<br />
<br />
The Administrative Court of Baden Wüttemberg ruled that the legal basis for corrections of the register of residents is no longer the German registration law but Article 16 sentence 1 GDPR.<br />
<br />
Furthermore, if it is not possible to clarify a data subjects actual date of birth for the register of residents, the data subject is not entitled to restriction of processing under Article 18 GDPR, to the entry of the date of birt claimed by him/her nor to the replacement of his year of birth by the sequence of numbers "0000".<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff was born in the Republic of Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01.01.19<u>56</u> and later corrected to 01.01.19<u>58</u> (following a ruling of the District Court Sarız in 1971). When moving to Germany in 1971, the plaintiff stated 01.01.1958 as his date of birth. This date was entererd into defendant's register of residents. <br />
<br />
In 2015, after the discovery of new documents by the plaintiff the District Court of Kayseri ruled that the plaintiff's date of birth in the civil status register in the district of Kayseri would be corrected to 01.01.19<u>53</u>. The plaintiff also received a new Turkish passport showing that date. Subsequently, the plaintiff requested the defendant to change his date of birth to 01.01.1953, which was rejected due to lack of certainty on the plaintiff's actual date of birth. After the plaintiff's objections to this rejection were dismissed by the Karlsruhe Regional Council, the plaintiff filed a complaint with the Administrative Court of Karlsruhe, which ordered the defendant to correct the plaintiff's date of birth recorded in the register of residents from 01.01.1958 to 01.01.1953. The defendant appealed againts that decision. <br />
<br />
===Dispute===<br />
Two disputes werde adressed from a data protection perspective:<br />
<br />
1) What is the legal basis for a request for rectification of an entry in the register of residents if the request has been submitted before the GDPR entered into force but has not yet been decided on as valid or legally binding?<br />
<br />
2) What are the consequences if the plaintiff requests the rectification of an entry in the register of residents and it is not possible to clarify when the plaintiff was actually born ("non liquet")? Does this entitle the plaintiff to<br />
<br />
(i) restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR,<br />
<br />
(ii) the entry of the date of birth claimed by the plaintiff or<br />
<br />
(iii) the replacement of his year of birth by the sequence of numbers "0000"?<br />
<br />
===Holding===<br />
The Court held that Article 16 sentence 1 GDPR is the legal basis for a request for rectification, even if the request has been submitted before the GDPR entered into force: <br />
<br />
"''According to Article 16 sentence 1 GDPR, every data subject has the right to request the controller (see Article 4(7) GDPR) to correct incorrect personal data concerning him/her without delay''. [...] ''These provisions of the GDPR which entered into force on 25.05.2016 and has been applicable since 25.05.2018 (see Article 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the plaintiff submitted his request for rectification as early as 2015 and thus before the GDPR entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the GDPR that data processing operations which have already begun at the time of the application of the GDPR should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25.05.2018 (see Recital 171 of the GDPR).''" <br />
<br />
Furthermore, if it is not possible to clarify the plaintiff's actual date of birth for the register of residents ("non liquet"), the plaintiff is not entiteled to he entry of the date of birth claimed by the plaintiff. Rather, in such a case the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect. The national law also does not entitle the plaintiff to have the entry in the register of residents concerning his year of birth ("1958") replaced by the numerical sequence "0000". <br />
<br />
Lastly, as regards the plaintiffs request for restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR the Court held that § 12 of the German Registration Law explicitly exludes the application of Article 18 (1)(a) GDPR. According to the Court, this exclusion is line with Article 23(1)(c) and (2) GDPR. <br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_Baden-W%C3%BCrttemberg_-_1_S_397/19&diff=10192VGH Baden-Württemberg - 1 S 397/192020-05-11T13:31:42Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VGH Baden-Wüttemberg - 1 S 397/19<br />
|-<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG Baden-Wüttemberg (Germany)|VG Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 16 GDPR#|Article 16 GDPR]] <br />
[[Category:Article 16 GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 17(1)(d) GDPR]] <br />
[[Category:Article 17(1)(d) GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 18(1)(a) GDPR]] <br />
[[Category:Article 18(1)(a) GDPR]]<br />
<br />
[[Article 18 GDPR#2|Article 18(2) GDPR]] <br />
[[Category:Article 18(2) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(c) GDPR]] <br />
[[Category:Article 23(1)(c) GDPR]]<br />
<br />
[[Article 23 GDPR#2|Article 23(2) GDPR]]<br />
[[Category:Article 23(2) GDPR]]<br />
<br />
[[Article 99 GDPR#|Article 99 GDPR]]<br />
[[Category:Article 99 GDPR]]<br />
<br />
[https://www.gesetze-im-internet.de/bmg/__12.html § 12 German Registration Law (Bundesmeldegesetz)]<br />
|-<br />
|Decided:||10. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||1 S 397/19<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||n/a<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=30900]<br />
|}<br />
<br />
The Administrative Court of Baden Wüttemberg ruled that the legal basis for corrections of the register of residents is no longer the German registration law but Article 16 sentence 1 GDPR.<br />
<br />
Furthermore, if it is not possible to clarify a data subjects actual date of birth for the register of residents, the data subject is not entitled to restriction of processing under Article 18 GDPR, to the entry of the date of birt claimed by him/her nor to the replacement of his year of birth by the sequence of numbers "0000".<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff was born in the Republic of Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01.01.19<u>56</u> and later corrected to 01.01.19<u>58</u> (following a ruling of the District Court Sarız in 1971). When moving to Germany in 1971, the plaintiff stated 01.01.1958 as his date of birth. This date was entererd into defendant's register of residents. <br />
<br />
In 2015, after the discovery of new documents by the plaintiff the District Court of Kayseri ruled that the plaintiff's date of birth in the civil status register in the district of Kayseri would be corrected to 01.01.19<u>53</u>. The plaintiff also received a new Turkish passport showing that date. Subsequently, the plaintiff requested the defendant to change his date of birth to 01.01.1953, which was rejected due to lack of certainty on the plaintiff's actual date of birth. After the plaintiff's objections to this rejection were dismissed by the Karlsruhe Regional Council, the plaintiff filed a complaint with the Administrative Court of Karlsruhe, which ordered the defendant to correct the plaintiff's date of birth recorded in the register of residents from 01.01.1958 to 01.01.1953. The defendant appealed againts that decision. <br />
<br />
===Dispute===<br />
Two disputes werde adressed from a data protection perspective:<br />
<br />
1) What is the legal basis for a request for rectification of an entry in the register of residents if the request has been submitted before the GDPR entered into force but has not yet been decided on as valid or legally binding?<br />
<br />
2) What are the consequences if the plaintiff requests the rectification of an entry in the register of residents and it is not possible to clarify when the plaintiff was actually born ("non liquet")? Does this entitle the plaintiff to<br />
<br />
(i) restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR,<br />
<br />
(ii) the entry of the date of birth claimed by the plaintiff or<br />
<br />
(iii) the replacement of his year of birth by the sequence of numbers "0000"?<br />
<br />
===Holding===<br />
The Court held that Article 16 sentence 1 GDPR is the legal basis for a request for rectification, even if the request has been submitted before the GDPR entered into force: <br />
<br />
"''According to Article 16 sentence 1 GDPR, every data subject has the right to request the controller (see Article 4(7) GDPR) to correct incorrect personal data concerning him/her without delay''. [...] ''These provisions of the GDPR which entered into force on 25.05.2016 and has been applicable since 25.05.2018 (see Article 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the plaintiff submitted his request for rectification as early as 2015 and thus before the GDPR entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the GDPR that data processing operations which have already begun at the time of the application of the GDPR should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25.05.2018 (see Recital 171 of the GDPR).''" <br />
<br />
Furthermore, if it is not possible to clarify the plaintiff's actual date of birth for the register of residents ("non liquet"), the plaintiff is not entiteled to he entry of the date of birth claimed by the plaintiff. Rather, in such a case the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect. The national law also does not entitle the plaintiff to have the entry in the register of residents concerning his year of birth ("1958") replaced by the numerical sequence "0000". <br />
<br />
Lastly, as regards the plaintiffs request for restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR the Court held that § 12 of the German Registration Law explicitly exludes the application of Article 18 (1)(a) GDPR. According to the Court, this exclusion is line with Article 23(1)(c) and (2) GDPR. <br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:VGH_Baden-W%C3%BCrttemberg_(Germany)&diff=10190Category:VGH Baden-Württemberg (Germany)2020-05-11T13:28:07Z<p>Juliette Leportois: Juliette Leportois moved page Category:VGH Baden-Wüttemberg (Germany) to Category:VG Baden-Wüttemberg (Germany) over redirect</p>
<hr />
<div>Here you can find all decisions by the Administrative Court of Baden-Württemberg, Germany (''Verwaltungsgerichtshof - "VG"'').<br />
[[Category:German Court Decisions]]<br />
{{DEFAULTSORT:Category:VG_Baden-Wüttemberg_(Germany)}}</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:VGH_Baden-W%C3%BCrttemberg_(Germany)&diff=10189Category:VGH Baden-Württemberg (Germany)2020-05-11T13:27:21Z<p>Juliette Leportois: </p>
<hr />
<div>Here you can find all decisions by the Administrative Court of Baden-Württemberg, Germany (''Verwaltungsgerichtshof - "VG"'').<br />
[[Category:German Court Decisions]]<br />
{{DEFAULTSORT:Category:VG_Baden-Wüttemberg_(Germany)}}</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:VGH_Baden-W%C3%BCrttemberg_(Germany)&diff=10188Category:VGH Baden-Württemberg (Germany)2020-05-11T13:27:07Z<p>Juliette Leportois: </p>
<hr />
<div>Here you can find all decisions by the Administrative Court of Baden-Württemberg, Germany (''Verwaltungsgerichtshof - "VGH"'').<br />
[[Category:German Court Decisions]]<br />
{{DEFAULTSORT:Category:VG_Baden-Wüttemberg_(Germany)}}</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VGH_Baden-W%C3%BCrttemberg_-_1_S_397/19&diff=10187VGH Baden-Württemberg - 1 S 397/192020-05-11T13:26:29Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VGH Baden-Wüttemberg - 1 S 397/19<br />
|-<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VGH Baden-Wüttemberg (Germany)|VGH Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VGH Baden-Wüttemberg (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 5 GDPR#1|Article 5(1)(d) GDPR]] <br />
[[Category:Article 5(1)(d) GDPR]]<br />
<br />
[[Article 16 GDPR#|Article 16 GDPR]] <br />
[[Category:Article 16 GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 17(1)(d) GDPR]] <br />
[[Category:Article 17(1)(d) GDPR]]<br />
<br />
[[Article 18 GDPR#1|Article 18(1)(a) GDPR]] <br />
[[Category:Article 18(1)(a) GDPR]]<br />
<br />
[[Article 18 GDPR#2|Article 18(2) GDPR]] <br />
[[Category:Article 18(2) GDPR]]<br />
<br />
[[Article 23 GDPR#1|Article 23(1)(c) GDPR]] <br />
[[Category:Article 23(1)(c) GDPR]]<br />
<br />
[[Article 23 GDPR#2|Article 23(2) GDPR]]<br />
[[Category:Article 23(2) GDPR]]<br />
<br />
[[Article 99 GDPR#|Article 99 GDPR]]<br />
[[Category:Article 99 GDPR]]<br />
<br />
[https://www.gesetze-im-internet.de/bmg/__12.html § 12 German Registration Law (Bundesmeldegesetz)]<br />
|-<br />
|Decided:||10. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||1 S 397/19<br />
|-<br />
|European Case Law Identifier:||n/a<br />
|-<br />
|Appeal from:||n/a<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=30900]<br />
|}<br />
<br />
The Administrative Court of Baden Wüttemberg ruled that the legal basis for corrections of the register of residents is no longer the German registration law but Article 16 sentence 1 GDPR.<br />
<br />
Furthermore, if it is not possible to clarify a data subjects actual date of birth for the register of residents, the data subject is not entitled to restriction of processing under Article 18 GDPR, to the entry of the date of birt claimed by him/her nor to the replacement of his year of birth by the sequence of numbers "0000".<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff was born in the Republic of Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01.01.19<u>56</u> and later corrected to 01.01.19<u>58</u> (following a ruling of the District Court Sarız in 1971). When moving to Germany in 1971, the plaintiff stated 01.01.1958 as his date of birth. This date was entererd into defendant's register of residents. <br />
<br />
In 2015, after the discovery of new documents by the plaintiff the District Court of Kayseri ruled that the plaintiff's date of birth in the civil status register in the district of Kayseri would be corrected to 01.01.19<u>53</u>. The plaintiff also received a new Turkish passport showing that date. Subsequently, the plaintiff requested the defendant to change his date of birth to 01.01.1953, which was rejected due to lack of certainty on the plaintiff's actual date of birth. After the plaintiff's objections to this rejection were dismissed by the Karlsruhe Regional Council, the plaintiff filed a complaint with the Administrative Court of Karlsruhe, which ordered the defendant to correct the plaintiff's date of birth recorded in the register of residents from 01.01.1958 to 01.01.1953. The defendant appealed againts that decision. <br />
<br />
===Dispute===<br />
Two disputes werde adressed from a data protection perspective:<br />
<br />
1) What is the legal basis for a request for rectification of an entry in the register of residents if the request has been submitted before the GDPR entered into force but has not yet been decided on as valid or legally binding?<br />
<br />
2) What are the consequences if the plaintiff requests the rectification of an entry in the register of residents and it is not possible to clarify when the plaintiff was actually born ("non liquet")? Does this entitle the plaintiff to<br />
<br />
(i) restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR,<br />
<br />
(ii) the entry of the date of birth claimed by the plaintiff or<br />
<br />
(iii) the replacement of his year of birth by the sequence of numbers "0000"?<br />
<br />
===Holding===<br />
The Court held that Article 16 sentence 1 GDPR is the legal basis for a request for rectification, even if the request has been submitted before the GDPR entered into force: <br />
<br />
"''According to Article 16 sentence 1 GDPR, every data subject has the right to request the controller (see Article 4(7) GDPR) to correct incorrect personal data concerning him/her without delay''. [...] ''These provisions of the GDPR which entered into force on 25.05.2016 and has been applicable since 25.05.2018 (see Article 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the plaintiff submitted his request for rectification as early as 2015 and thus before the GDPR entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the GDPR that data processing operations which have already begun at the time of the application of the GDPR should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25.05.2018 (see Recital 171 of the GDPR).''" <br />
<br />
Furthermore, if it is not possible to clarify the plaintiff's actual date of birth for the register of residents ("non liquet"), the plaintiff is not entiteled to he entry of the date of birth claimed by the plaintiff. Rather, in such a case the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect. The national law also does not entitle the plaintiff to have the entry in the register of residents concerning his year of birth ("1958") replaced by the numerical sequence "0000". <br />
<br />
Lastly, as regards the plaintiffs request for restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR the Court held that § 12 of the German Registration Law explicitly exludes the application of Article 18 (1)(a) GDPR. According to the Court, this exclusion is line with Article 23(1)(c) and (2) GDPR. <br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Legal basis for a claim for correction of the civil register; binding effect of decisions of Turkish courts to change the entry on the date of birth of Turkish citizens residing in Germany; relevance of entries in a foreign passport; collection of evidence<br />
Guiding Principles<br />
1 The legal basis for a claim for correction of the registration register is no longer § 12 BMG (old version), but Art. 16 sentence 1 DSGVO. This also applies to applications for correction submitted before the DSGVO came into force but which have not yet been decided on as valid or legally binding.<br />
<br />
<br />
<br />
2) If a Turkish court orders the change of the entry in the Turkish civil status register on the date of birth of a Turkish citizen resident in Germany, neither the German registration authorities nor the administrative courts are bound by this judgment in the sense that the date of birth stated in the judgment must be adopted in the German registration law without being checked.<br />
<br />
<br />
<br />
3. a foreign passport cannot provide proof of the correctness of the date of birth stated there. The registration authorities are not obliged to accept a date of birth stated in such a passport without verification.<br />
<br />
<br />
<br />
4) If the plaintiff asserts against the defendant institution of the registration authority a claim based on Article 16 sentence 1 of the DPA to replace a date of birth entered in the register of residents which the plaintiff considers to be "incorrect" with another date which the plaintiff considers to be "correct", and if it is not possible to establish when the plaintiff was actually born ("non liquet"), this does not mean that the plaintiff has a claim to restriction of data processing under or by analogy with Article 18.1(a) DPA. Nor does such a "non liquet" entail a claim by the plaintiff to registration of the date he has named. Rather, in such a case, the action must be dismissed in accordance with the rules of national law on the burden of proof, which are also applicable within the scope of application of Art. 16 DSGVO.<br />
<br />
<br />
<br />
5) In the event of such a "non liquet", the plaintiff also has no claim against the defendant that the previous entry in the register of birth cohorts be replaced by the sequence of numbers "0000".<br />
Tenor<br />
On appeal by the defendant, the judgment of the Karlsruhe Administrative Court of 25 April 2018 - 1 K 5594/15 - is amended. The action is dismissed.<br />
Orders the applicants to pay the costs of the proceedings at both instances.<br />
The revision is allowed.<br />
Facts<br />
<br />
<br />
1 <br />
The plaintiff requests that the information on his year of birth in the defendant's register of residents be changed.<br />
<br />
2 <br />
The plaintiff was born in the Republic of Turkey in ..., district town Sarız, in the district of Kayseri, as the son of ... and the... born ... born. He is a Turkish citizen, has been living in Germany since 1971 and is in receipt of a pension until ... temporary pension due to full reduction in earning capacity from ....<br />
<br />
3 <br />
The plaintiff's birth was first recorded in the civil status register in the district of Kayseri on ...1959. The date of birth was initially entered as "01.01.1956" (cf. excerpt from the register of civil status [Nüfus Kayıt Örneği] of ..., table "Erläuterungen", pp. 103 f. of the VG file).<br />
<br />
4 <br />
At the request of the - now deceased - father of the plaintiff, the District Court Sarız decided in a ruling of 16 June 1971 that "the previous official date of birth entry (...) was declared invalid" and that the date "01 January 1958" was the correct date. The registry office ("Register Office") was instructed to enter the corrected date of birth. In the reasons for the ruling, the Local Court Sarız stated, inter alia<br />
<br />
5 <br />
"The applicant's witness... "that the applicant's young son was born in 1958.<br />
<br />
6 <br />
Our court was able to convince itself on the basis of its own observation of little ...-..., his behaviour and condition, his physical appearance and to the best of its knowledge and belief that he was born in 1958 (...)".<br />
<br />
7 <br />
The judgment was enforced by means of a corrective note in the civil registry of the district of Kayseri.<br />
<br />
8 <br />
In 1971, the plaintiff moved to the Federal Republic of Germany. There he first stated "01.01.1958" as his date of birth. This date was also entered in the defendant's register of residents.<br />
<br />
9 <br />
In the... ...the plaintiff married a Turkish woman who died on... with the surname... born witness ....<br />
<br />
10 <br />
In 2009, the plaintiff tried to obtain certificates for his school attendance in Turkey. The district administration office - education authority - Sarız informed him that investigations had revealed "that ..., son of ..., in the school year 1961/62 in the first class of the school year 1961/62, in the first grade of the Turkish National School of Economics, he was the son of ... "of the elementary school in our borough." This certificate had been issued "at the request of the person concerned" (certificate of the District Administrator's Office Sarız of ...2009, sheet 1 f. d. Verw.-Akte). The ...-Hauptschule also stated that it had taken over the documents from the ...-...-Mittelschule which had been closed in the meantime. According to these documents, the student who had been attending ... ...born in..., son of... ...and ..., was registered at the ... middle school on 31.08.1967. He had remained at school in the 1967/68 school year. On 25.10.1968 he was registered with confirmation no. ... on 25 October 1968, because he had failed to repeat the first grade (of the secondary school) in the school year 1968/69 (certificate of ... 2009, pp. 5 f. of the Verw. file).<br />
<br />
11 <br />
On application by the plaintiff of 15 September 2014, the District Court of Kayseri, in proceedings conducted against the Kayseri registry office, decided in a judgement of 17 January 2015 that the date of birth of the plaintiff, which had been registered on 11 September 1959 as "01 January 1958", would be corrected to "01 January 1953". With regard to the facts of the case and the reasons for the decision of this judgment, reference is made to sheet 95 et seq. of the file of the Administrative Court (Annex K 2). The judgement was executed by means of a correction note in the register of civil status of the district of Kayseri.<br />
<br />
12 <br />
On ...2015, the plaintiff was granted by the Republic of Turkey... ...valid until the end of the year. The date of birth mentioned therein is "01.01.1953" (see sheet 17 of the Verw. file).<br />
<br />
13 <br />
In April or May 2015, the plaintiff applied, on presentation of his passport, the aforementioned judgment of the Kayseri District Court and the school certificates, to change the date of his birth in the defendant's register of residents from "01.01.1958" to "01.01.1953".<br />
<br />
14 <br />
The defendant rejected this request by decision of 03.08.2015. The Karlsruhe Regional Council dismissed the objection raised against it with the notice of objection dated 06.11.2015.<br />
<br />
15 <br />
On December 10, 2015, the plaintiff filed a complaint with the Administrative Court of Karlsruhe. To substantiate his claim, he submitted photographs (Annex K 1) and explained that picture 1 was taken on 13.09.1974 and showed a person who was considerably older than 16 years (calculated from 01.01.1958). Picture 2 was taken after 1973 and shows him with his mother and his son. born brother ..., who ... came to Germany. Pictures 3 to 5 are photographs of his (the plaintiff's) wedding in ....the "The German Museum". These pictures do not show a 17-year-old (calculated from 01.01.1958), but an adult man. The Plaintiff further submitted that his request for correction was also to be granted because the judgment of the Regional Court Kayseri pursuant to § 328 of the FamFG (meant: § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 328 of the Code of Civil Procedure and §§ 108 et seq. of the FamFG) and pursuant to the "Convention concerning Decisions on the Correction of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq.) was decisive. In any event, the defendant had not accepted the extract from the corrected Turkish civil-status register of ... in accordance with the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966).<br />
<br />
16 <br />
In its judgement of 25.04.2018 - 1 K 5594/15 - the Administrative Court ordered the defendant to correct the plaintiff's date of birth stored in the register of residents from "01.01.1958" to "01.01.1953" by annulling its decision of 03.08.2015 and the notice of objection of 06.11.2015. In its reasoning, it stated that the action was admissible, in particular that, contrary to the defendant's submissions, the plaintiff did not lack the need for legal protection and did not conduct the proceedings in an abusive manner. The action is also well founded. For the assessment of the question whether the plaintiff's date of birth (1 January 1958) entered in the registration register was incorrect, the court did not have to consider whether the judgment of the Regional Court Kayseri, in which the plaintiff's date of birth was corrected to 1 January 1953, had a binding effect on the registration authorities or whether a taking of evidence would reveal the incorrectness of the date of birth "1 January 1958" and the correctness of the date of birth "1 January 1953". Certain doubts as to the correctness of the content of the judgment of the Regional Court Kayseri could also be based on this. For the question whether the plaintiff's date of birth entered in the register of residents within the meaning of § 12 sentence 1 of the Federal Ministry of Health was incorrect and had to be corrected, the decisive point to be made was that in his official identity papers, in this case his Turkish passport, the date of birth was entered as 1 January 1953. According to § 2.1 of the Federal Ministry of Health, it was the task of the registration authorities to register the persons residing in their area of responsibility in order to be able to establish and prove their identity and their homes. However, it was not possible, or only possible with difficulty, to establish the identity of the plaintiff if his official foreign identity document contained a different date of birth from that which was recorded in the register of residents.<br />
<br />
17 <br />
On application by the defendant, the Senate allowed an appeal against this ruling by order of 8 February 2019 - 1 S 1503/18.<br />
<br />
18 <br />
In support of its claims, the defendant argues that the right of correction under Section 12 of the Federal Ministry of Health (old version) presupposes that the stored data is incorrect. Whether the entry of a date of birth was incorrect could not be answered by reference to the entry in a foreign passport alone. This also applied to the present case, particularly since the date "01.01.1953" entered in the Turkish passport was itself incorrect or in any case not demonstrably correct. The entry in the passport is based on the decision of the Regional Court of Kayseri of 17.01.2015. However, there are massive doubts about its correctness. The court's findings of fact were already erroneous. It had been stated there that the plaintiff's date of birth had been registered in 1959 "as of 1 January 1958", which was incorrect according to the judgment of the Local Court Sarız. The Regional Court Kayseri had obviously not been aware of the decision of the Local Court and had assumed that the facts were incorrect. The witness statements quoted by the Regional Court were also questionable. The witness ... ... ... had described himself as the "grandson" of the plaintiff and had nevertheless stated that the plaintiff was born in 1952 or 1953. The other testimony acknowledged by the Regional Court came from the plaintiff's sister. The letter from a hospital further mentioned in the judgment of the Regional Court was not very meaningful. It covered a long period of time and it was not apparent when the age determination described in it had been carried out. If one assumes the originally determined date of birth "01.01.1956", enrolment in school in the school year 1961/62 and registration at the secondary school in 1967 was quite realistic. In addition, the Local Court Sarız had assessed the plaintiff "on the basis of its own observation". It was difficult to imagine that in 1971, when he was officially 15 years old, the plaintiff had been - as he now states - three years older, although the court had been convinced that he was two years younger than the age entered in the register at that time. The plaintiff's statements in the administrative court proceedings also gave rise to doubts as to the truth of his submission. He had asserted that the rectification proceedings conducted in 1971 had been applied for by his father because he (the plaintiff) was then still a minor. The latter statement contradicted his submission that he had been born in 1953. The judgment of the Regional Court was also not binding on legal grounds. A binding effect did not result either from international agreements or from domestic law such as § 173 sentence 1 of the Rules of the Administrative Courts in conjunction with § 173 sentence 1 of the German Rules of the Administrative Courts (VwGO). § 328 ZPO or §§ 108 et seq. FamFG. This was opposed by the reservation of the ordre public under the law of recognition because recognition of the judgment would lead to a result that was incompatible with fundamental principles of German law. On the one hand, the judgment of the Regional Court had been handed down in proceedings in which the principle of investigation applied, but not the principle of negotiation. The decision was also based on a legal situation in which Turkish citizens could have their date of birth changed without the correctness of the new date of birth being a prerequisite for this. Such a change of the date of birth was not possible under German law and was not compatible with it. Nor does the consideration of the Administrative Court that the plaintiff could get into difficulties if his official Turkish documents contained a different date from that in German documents confer on him a right of correction. A determination of identity remains possible even if the dates differ.<br />
<br />
19 <br />
The defendant claims that the Court should<br />
<br />
20 <br />
amend the judgment of the Verwaltungsgericht Karlsruhe of 25 April 2018 - 1 K 5594/15 - and dismiss the action<br />
<br />
21 <br />
The applicant claims that the Court should<br />
<br />
22 <br />
dismiss the appeal.<br />
<br />
23 <br />
He defends the judgment under appeal, arguing that, contrary to the defendant's view, the date of birth recorded in his Turkish passport is decisive in the present proceedings. According to the conflict-of-law personal statute of Article 5 of the Introductory Act to the Civil Code, the right of nationality is the relevant connection for the personal status characteristics and thus also for the date of birth, and the law primarily called upon to make a decision. The fact of civil status established by the state of origin must be decisive without further review, since it was an act of sovereignty of a foreign state with regard to the civil status of one of its citizens, which was to be recognised under the principle of sovereignty under international law. The defendant's doubts as to the correctness of the judgment of the Regional Court Kayseri were unfounded. The only decisive factor was whether the Regional Court had objectively correctly determined the date of birth, which is why the earlier judgment of the Local Court Sarız was not decisive. Insofar as the defendant derived reservations against the judgment of the Regional Court from the fact that the translation of the judgment stated that the witness ... had stated that he was the "grandson" of the plaintiff, the defendant ignored the fact that there was a translation error. It was not the grandson, but the elder (grand)cousin, namely the grandson of the plaintiff's aunt ("bibisinin torunu": "I am the grandson of the aunt"). It is not understandable why the defendant doubts the testimony of the plaintiff's sister. Close relatives could best remember events such as a birth. The defendant's objection that the judgment of the Regional Court was not admissible under § 328 of the Code of Civil Procedure and §§ 108 et seq. FamFG, was also unfounded. The defendant had not pointed out any fundamental principle of German law that would be violated by the recognition of the judgment. In particular, contrary to the submissions of the defendant, the principle of investigation generally applied in Turkish law and, irrespective of this, an assessment of evidence took place, even if this was not always sufficiently expressed in the rather concise Turkish judgments. In addition, the principle of presentation was also known in German civil procedural law.<br />
<br />
24 <br />
On October 8, 2019, the Senate passed a resolution... ... ... to obtain information on the question of whether it is medically possible to determine age for a disputed period such as that in question here (born in 1953, 1956 or 1958). With regard to the result, reference is made to the Senate's communication of 17 October 2019 to the parties involved. Furthermore, in the oral hearing of 10 March 2020, the Senate called the witness ... and the witness ... ... and the witness. Please refer to the minutes of the oral proceedings for the results of the hearing of evidence.<br />
<br />
25 <br />
For further details of the facts of the case and the dispute, reference is made to the defendant's administrative acts and the pleadings and annexes exchanged at both instances.<br />
<br />
Reasons for the decision<br />
<br />
A.<br />
<br />
26 <br />
The defendant's appeal, which is admissible after approval by the Senate and also admissible in all other respects, is well-founded. The Administrative Court wrongly allowed the appeal. The action is to be regarded as a combined action for rescission and action for performance (see Reif, in: Gola, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 25; a.A. Worms, in: Wolff/Brink, BeckOK Datenschutzrecht, 30th ed., Art. 16 DS-GVO: Obligation action) admissible and also otherwise admissible, but not justified.<br />
<br />
27 <br />
The defendant's decision of August 3, 2015 and the notice of objection of the Karlsruhe Regional Council of November 6, 2015 are lawful and do not violate the plaintiff's rights (see § 113, Subsection 1, Sentence 1, VwGO). He is not entitled to the alleged right of correction. He is neither entitled to the claim asserted in his main application that the defendant replace the current entry in the register of residents for his year of birth ("1958") with the entry "1953" (I.), nor to have the sequence of numbers "0000" entered there, as he requests in the auxiliary application (II.).<br />
I.<br />
<br />
28 <br />
The action is unfounded in the main claim.<br />
<br />
29 <br />
On the basis of the legal basis from Article 16 sentence 1 of the DSGVO (2.), which alone was applicable at the relevant point in time (1.), the plaintiff is not entitled to the asserted claim for correction aimed at the registration of the year of birth "1953". It is not certain with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of entitlement under Article 16 sentence 1 DSGVO for the requested correction (3.). Further measures to clarify the facts concerning the correct year of birth of the plaintiff do not exist or cannot be taken (4.). The decision on the burden of proof to be taken for this reason is to the disadvantage of the plaintiff (5.).<br />
<br />
30 <br />
1 The examination of the merits of the action shall be based on the factual and legal situation at the time of the Senate's oral hearing.<br />
<br />
31 <br />
The point in time at which an action is deemed to be well founded is not determined by procedural law but by the substantive law underlying the case in question. Decisive for the decision of a court are the legal provisions which are applicable at the time of the decision for the assessment of the claim, regardless of whether it is an action for a declaratory judgment, for performance, for avoidance or for an obligation (BVerwG, judgment of 3 November 1994 - 3 C 17.92 - BVerwGE 97, 79; Stuhlfauth, in: Bader et al., VwGO, 7th ed., § 113 marginal no. 34). If the plaintiff asserts - as here - a substantive claim against the legal entity of the authority to perform an act, the factual and legal situation at the time of the court's decision is in principle decisive for the question of the existence of the claim, unless the law applicable at that time expressly or implicitly orders that it is generally not yet relevant to the facts of the case in question or that at least for claims that were applied for in the past, the time of the application is to remain relevant (see BVerfGE 101, 286 (3)). BVerwG, judgment of 1 December 1989 - 8 C 17.87 - BVerwGE 84, 157; Wolff, in: Sodan/Ziekow, VwGO, 5th ed, § 113 marginal 102 ff. with further references).<br />
<br />
32 <br />
2 Based on this, section 12 of the Federal Registration Act in the old version (old version) of 20 November 2014, which applied at the time the plaintiff filed its application with the defendant and still applied when the Senate resolution of 8 February 2019 allowing the appeal was issued, is no longer relevant to the claim for correction asserted by the plaintiff. Rather, his request is based on Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation, OJ L 119 of 04.05.2016, p. 1, hereinafter referred to as "the Regulation"): DSGVO).<br />
<br />
33 <br />
§ Section 12 sentence 1 BMG old stipulated that if stored data are incorrect or incomplete, the reporting authority must correct or supplement the data at the request of the person concerned. However, this provision was amended by the Second Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU) of 20 November 2019 (Federal Law Gazette I 1626, 1638) with effect from 26 November 2019. § Section 12 of the Federal Ministry of Health has since read: "If the registration authority has corrected or completed the data at the request of the data subject pursuant to Article 16 of Regulation (EU) 2016/679, Section 6 (1) sentence 2 (Federal Ministry of Health as amended) shall apply accordingly. For the duration of the examination of the accuracy, the processing of the data is not restricted pursuant to Article 18(1)(a) of Regulation (EU) 2016/679. With this new version, the legislator wanted to make it clear that in the area of the right to report, the right of rectification arises directly from Article 16 DSGVO (see the explanatory memorandum to the Federal Government's draft bill, Bundestag printed paper 19/4674, p. 224).<br />
<br />
34 <br />
According to Art. 16 sentence 1 DGSVO, every data subject has the right to request the person responsible (cf. Art. 4 No. 7 DSGVO) to correct incorrect personal data concerning him/her without delay. Pursuant to Art. 16 sentence 2 DGSVO, he/she also has the right to request the completion of incomplete personal data, taking into account the purposes of the processing. These provisions of the basic data protection regulation which entered into force on 25 May 2016 and has been in force since 25 May 2018 (cf. Art. 99 DGSVO) are also applicable to the present case. This is not precluded by the fact that the applicant submitted his application for rectification as early as 2015 and thus before the Regulation entered into force. This is because the substantive law currently in force does not offer any reason to assume that Union law does not claim to apply to a situation such as the present case. The opposite is the case. The Union legislator has emphasised in the Basic Data Protection Regulation that data processing operations which have already begun at the time of the application of this Regulation should be "brought into conformity" with it within two years of its entry into force - i.e. until its first day of application on 25 May 2018 (see Recital 171 of the DSGVO). Accordingly, the Second Data Protection Adaptation and Implementation Act EU does not contain any deviating transitional provisions in this respect (cf. Art. 155 2 DSAnpUG-EU and Bundestag printed paper 19/4674, pp. 446 f.).<br />
<br />
35 <br />
3. in the light of the requirements of Article 16 of the DSGVO, the action with the principal claim is unfounded. It has not been established with the certainty required for the formation of judicial conviction that the plaintiff fulfils the conditions of Art. 16 sentence 1 DSGVO for the requested correction.<br />
<br />
36 <br />
According to Art. 16 sentence 1 DGSVO, as has been shown, every data subject has the right to demand that the person responsible "rectify" "incorrect personal data" concerning him/her without delay. The plaintiff's date of birth is indeed a "personal date" (a)). However, the Senate is not in a position to form the necessary conviction that the plaintiff's request to be entered in the register of residents as born "1953" is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DSGVO (b)).<br />
<br />
37 <br />
a) The plaintiff requests the correction of a "personal date" within the meaning of Art. 16 sentence 1 DSGVO.<br />
<br />
38 <br />
The definition of "personal data" covers all information relating to an identified or identifiable natural person - the "data subject" within the meaning of the DPA (Art. 4 No. 1 Para. 1 DPA). The term "information relating to persons" is to be understood broadly. This provision covers both personal information such as identifying features (e.g. name and address), external characteristics (such as sex, eye colour, height and weight) or internal conditions (e.g. opinions, motives, wishes, convictions and value judgements) and factual information relating to persons such as financial and ownership circumstances, communication and contractual relationships and all other relationships of the data subject with third parties and his or her environment. The "identification features" include in particular the date of birth of the person concerned, which is also subject to dispute here (see OLG Cologne, Urt. v. 26.07.2019 - 20 U 75/18 - juris; Klar/Kühling: in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed., Art. 4 DS-GVO marginal 8; Ernst, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed., Art. 4 marginal 14).<br />
<br />
39 <br />
b) However, it is not evident that the plaintiff's request to have "1953" entered in the register of births as the year of birth is aimed at the "correction" of an "incorrect" date within the meaning of Art. 16 sentence 1 DPA.<br />
<br />
40 <br />
The criterion of 'incorrectness', which is a Union law criterion and is therefore to be interpreted autonomously, is an objective criterion applicable only to factual statements. It is fulfilled if the information stored about the data subject in question does not correspond to reality (see Herbst, in: Kühling/Buchner, loc. cit, Art. 16 DS-GVO marginal 8; Kamann/Braun, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed., Art. 16 marginal 14; Paal, in: dems/Pauly, DS-GVO, BDSG, 2nd ed., Art. 16 DS-GVO marginal 15; Worms, op. cit, Art. 16 DS-GVO, marginal 49; also HambOVG, decision of 27 May 2019 - 5 Bf 225/18 Z - ZBR 2020, 49; see also Art. 5 para. 1 lit. d DS-GVO ["factually correct"]; also on § 12 BMG (old version) Süßmuth, Bundesmeldegesetz, 31st Lfg, § 12 margin no. 4 ["incorrect" is data if its content does not correspond to the facts of life which it reflects as information]; on § 10 HMG HessVGH, Urt. v. 30.10.1990 - 11 UE 3005/89 - ESVGH 41, 105; VG Frankfurt a.M., Urt. v. 29.07.2011 - 5 K 156/11.F - juris; to § 9 MRRG Medert/Süßmuth, Melderecht, Stand 3. Lfg., § 9 MRRG marginal no. 4 with further reference). The stored or otherwise processed information on a date of birth is therefore also "incorrect" within the meaning of Art. 16 sentence 1 DSGVO if the information is objectively incorrect (Reif, loc.cit., Art. 16 marginal no. 11).<br />
<br />
41 <br />
According to Art. 16 sentence 1 DSGVO, the "correction" of an incorrect date may be requested. In accordance with the above, this can only be done by bringing the incorrect date into line with reality (see Worms, loc. cit., Art. 16 margin no. 61; Herbst, in: Kühling/Buchner, loc. cit., Art. 16 DS-GVO margin no. 18; in the same way, the same conclusion has already been reached on § 12 BMG old version BVerwG, judgement v. 30 September 2015 - 6 C 38.14 -, NJW 2016, 99; Senate, decision of 07 March 2016 - 1 S 309/16 -).<br />
<br />
42 <br />
A claim for correction can therefore only arise from Art. 16 sentence 1 DSGVO if - firstly - it is established that the date stored or otherwise processed by the person responsible does not objectively correspond to reality, and if - secondly - it is also established at the same time that the date designated by the person concerned as correct actually corresponds to reality.<br />
<br />
43 <br />
In the present case, the Senate is not able to form such a certainty of conviction. There is much to be said for the fact that the defendant's date of birth ("1 January 1958") stored in the plaintiff's register of residents is objectively incorrect. However, the Senate is not convinced that the date of birth that the plaintiff requests to be entered ("01.01.1953") is objectively correct.<br />
<br />
44 <br />
The plaintiff is not able to prove the correctness of the date of birth "01.01.1953" solely by reference to the entry to that effect in his Turkish passport (aa)). The Senate is also not bound by the judgment of the Regional Court of Kayseri on the basis of international treaties or national recognition regulations in the sense that the date of birth determined by the Regional Court ("01.01.1953") would have to be adopted in the present proceedings without being checked (bb)). Nor does such a binding effect result from the current entry of the date of birth in the Turkish civil status register, the register extract submitted by the plaintiff from it or from international treaties relating to such extracts (cc)). Nor do the provisions of private international law referred to by the plaintiff (Art. 5 EGBGB) establish such a commitment (dd)). It must therefore be decided by way of free assessment of evidence whether the date of birth registered by the defendant is incorrect and the date of birth indicated by the plaintiff is correct (ee)). This assessment of evidence shows that the correctness of the last date of birth stated by the plaintiff is not certain with the certainty required for the formation of a judicial conviction ("non liquet").<br />
<br />
45 <br />
aa) The fact that the date of birth ("01.01.1958") recorded by the defendant in the registration register for the plaintiff is objectively incorrect and the date ("01.01.1953") stated by him is correct is not certain simply because the plaintiff's Turkish is entered as the date of birth "01.01.1953".<br />
<br />
46 <br />
In order to determine the actual - objectively correct - date of birth, a document which is admittedly an official document in the context of the required assessment of evidence - in the administrative process according to the rules of documentary evidence - may have to be assessed (see § 98 VwGO in conjunction with §§ 415 ff. ZPO). However, contrary to the view of the Administrative Court, the determination of the facts cannot in principle be limited to a consideration of the information in the document. In particular, foreign passports are not suitable for the sole purpose of providing proof of the correctness of the date of birth stated therein. The scope of the evidential value of public documents - including foreign public documents (see § 438 ZPO and BVerwG, decision of 28 June 2010 - 5 B 49.09 - NVwZ 2012, 1162; OVG NW, judgment of 27.05.2011 - 12 A 2561/09 - juris) - results from the statutory rules of evidence in sections 415, 417 and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition or decision within the meaning of § 417 ZPO (OVG Bln.-Brbg., decision of 04.03.2013 - OVG 6 S 3.13 - juris). Its probative force is therefore determined according to § 418 (3) ZPO. According to this provision, it only provides full proof of the facts attested to in it to the extent that they are based on the actions or perceptions of the notary public (see OVG Bln.-Brbg., decision of 4 March 2013, loc.cit., and decision of 30 April 2012 - OVG 2 N 16.11 -, juris m.w.N.). Accordingly, no proof can be provided for the correctness of the date of birth stated therein (OVG Bln.-Brbg., decision of 4 March 2013, op. cit., and decision of 19 July 2011 - OVG 2 N 82.09 - juris; VG Berlin, judgement of 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; see also OVG Bremen, decision of 06.11.2018 - 1 B 184.18 - juris).<br />
<br />
47 <br />
Nor can a link to the information in the foreign document be justified by the administrative court's consideration that under Section 2 (1) of the Federal Law on the Registration of Residents (old and new versions) it is the task of the registration authorities to register the persons residing in their area of jurisdiction in order to establish and prove their identity and their homes, and that it is not possible or only possible with difficulty to establish the identity of the plaintiff if a different date of birth is entered in his official foreign identity document than the one entered in the register of residents. The entry of the date of birth in the register of residents reflects as information that the person concerned was born on the date stated there. On the other hand, the entry in the population register does not imply that another document, such as a foreign document, states that the person was born on that date. In view of this declaration content of the population register, the answer to the question whether the entry of a date of birth in the population register is "incorrect" cannot be based solely on the entry in another official document such as a foreign document. Rather, it must also be determined in this context whether the person concerned was actually - objectively - born on the date stated in the registration register. This already corresponded to applicable law under the application of § 12 of the old version of the Federal Ministry of Health (see VG Bremen, judgement of 20 April 2018 - 2 K 2704/16 - juris) and applies all the more within the scope of application of Article 16.1 of the DPA and the concept of "incorrectness" there (see again above under a)).<br />
<br />
48 <br />
bb) The Senate is also not bound by international treaties or domestic legal provisions to the judgement of the District Court of Kayseri of 17 January 2015 in the sense that the date of birth established by the District Court ("01 January 1953") would have to be adopted in the present proceedings without being checked.<br />
<br />
49 <br />
There is no general obligation under international law to recognise foreign court decisions (Geimer, in: Zöller, ZPO, 33rd ed., § 328 marginal no. 1). Rather, it is in principle at the discretion of the respective national legislator to determine whether and, if so, in what way and to what extent such decisions are recognised in its own legal system (Gottwald, in: Münchener Kommentar zur ZPO, 5th ed., § 328 marginal no. 4).<br />
<br />
50 <br />
In German law, an obligation to recognition may arise primarily from provisions of Union law and secondarily from international agreements, insofar as these have become directly applicable state law. If no provisions of Union or international treaty law are relevant in the respective individual case, the recognition of foreign decisions in the area of family law and voluntary jurisdiction is governed by §§ 108 f. FamFG (cf. § 97.1 FamFG) and within the scope of application of the Code of Civil Procedure, i.e. essentially in civil and commercial matters (Stadler, Musielak/Voit, ZPO, 16th ed., § 328 marginal no. 5), according to the principle of mutual recognition, which is laid down in §§ 108 f. FamFG (see Gottwald, loc.cit., § 328 marginal 17, 60; Stadler, loc.cit., § 328 marginal 3, 6; Sieghörtner, in: Hahne et al., BeckOK FamFG, 33rd ed., § 108 marginal 30). In this context, the distinction between the above-mentioned domestic recognition provisions depends on whether the foreign decision, if it had been taken by a German court, would have had to be classified as a "FamFG" or "ZPO matter" (see BayVGH, decision of 11 December 1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; Sieghörtner, loc. cit.) Sections 108 et seq. are also applicable to civil-status matters. FamFG are also applicable. For under § 51.1 sentence 1 PStG the provisions of the Act on Proceedings in Family Matters and in Matters of Voluntary Jurisdiction are to be applied to judicial proceedings within the scope of application of the Persons Status Act (see, for example, KG Berlin, Order of 4 July 2017 - 1 W 153/16 - StAZ 2018, 183 and of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348).<br />
<br />
51 <br />
In administrative court proceedings, the recognition of foreign judgments is in principle also based on the legal bases mentioned above. According to § 173 sentence 1 VwGO, § 328 ZPO, among others, is to be applied accordingly. This basic norm under recognition law is, if necessary, also enforced in the administrative process by the special provisions of § 108 Para. 1 in conjunction with § 328 ZPO. § 109 FamFG (see BVerwG, Urt. v. 29 November 2012 - 10 C 4.12 - BVerwGE 145, 153; OVG Bln.-Brbg. 12.07.2017 - OVG 11 B 5.16 - juris; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; NdsOVG, judgment of 29.09.2014 - 11 LB 2203/14 - NdsVBl. 2015, 24; BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -, BayVBl. 1982, 240; VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Clausing, in: Schoch/Schneider/Bier, VwGO, 37th Erg.-Lfg.)<br />
<br />
52 <br />
On this basis, the Senate is not bound by the judgment of the Kayseri Regional Court of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("01 January 1953") would have to be adopted in the present proceedings without being reviewed. In the present case, a commitment to this effect cannot result from provisions of Union law, as the Republic of Turkey is not a member state of the European Union. Nor does a binding effect result from international treaties (1) or the national provisions of § 173 sentence 1 VwGO in conjunction with § 173 sentence 1 VwGO. § 328 ZPO or §§ 108 f. FamFG (2).<br />
<br />
53 <br />
(1) The judgment of the District Court of Kayseri is not bound by the "Convention on Decisions concerning Corrections of Entries in Civil Status Books (Civil Status Registers)" of 10 September 1964 (Federal Law Gazette II p. 445 et seq., hereinafter referred to as CIEC Convention No. 9) referred to by the plaintiff and signed by the Federal Republic of Germany and the Republic of Turkey. None of the provisions of this Convention is relevant to the present proceedings.<br />
<br />
54 <br />
According to the first sentence of Article 2 of CIEC Convention No 9, the authority of a Contracting State which is competent to decide on the correction of an entry in a civil-status register kept in its own territory is also competent to order, in the same decision, the correction of the same error which has been reproduced in a subsequent entry in the civil-status register of another Contracting State and which concerns the same person or his descendants. This decision shall then be enforceable in the other State in accordance with the second sentence without further formality.<br />
<br />
55 <br />
Those provisions do not go further in the present case, if only because the first sentence of Article 2(1) of CIEC Convention No 9 concerns only entries in civil-status records. The provision is therefore - like the entire Convention - intended for civil status authorities, i.e. in Germany for the registry offices (see Baumann, StAZ 1968, 337 f.), but not - as here - for registration authorities (see VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 190, 326 f.; i.e. probably BayVGH, decision of 11.12.1981 - 10 CS 81 A.2341 -BayVBl. 1982, 240, but without justification; left open by VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45).<br />
<br />
56 <br />
Irrespective of that, Article 2, first sentence, of CIEC Convention No 9 could not, in the present case, give rise to any binding effect in its scope either. This follows, on the one hand, from the fact that in the above-mentioned judgment the Regional Court of Kayseri did not make an "error order" within the meaning of Art. 2 sentence 1 of the Convention (see Düsseldorf Higher Regional Court, Order of 9 May 1997 - 3 Wx 261/96 - StAZ 1997, 276). In addition, Article 2 of the Convention does not in any case establish an unlimited obligation to foreign judgments in its scope of application. Rather, the Convention expressly provides for the possibility that the enforcement of a foreign judgment may be refused if it is incorrect (cf. Article 4 of the Convention). This shows that the correctness of the content of the foreign judgment need not be assumed by the competent domestic authorities without being examined (see VGH Bad.-Württ. 22.10.1987, loc. cit.; BayVGH, decision of 11.12.1981, loc. cit.)<br />
<br />
57 <br />
Nor does Article 3 of CIEC Convention No 9 go further in the present case. That provision provides that, where a decision to correct an entry in a civil status register has been issued by the competent authority of a Contracting State, those transfers or endorsements shall also be corrected if the entry has been transferred to or entered in the civil status register of another Contracting State, on presentation, where appropriate, of a copy of the decision to correct and a copy of the corrected entry.<br />
<br />
58 <br />
The fact that there is no entry in a German register of civil status again precludes the application of that provision to the present case. Irrespective of that, there is no transfer or endorsement within the meaning of the aforementioned provisions. The plaintiff's birth was not transferred as an entry from a Turkish civil-status register to a German civil-status register (see on this precondition BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; see also OLG Düsseldorf, decision of 09.05.1997, loc. cit.; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Baumann, StAZ 1968, 337 <338>).<br />
<br />
59 <br />
(2) Also from the national recognition regulations from § 173 sentence 1 VwGO in conjunction with § 328 ZPO and §§ 108 f. FamFG do not bind the Senate to the judgment of the Regional Court of Kayseri of 17 January 2015 in the sense that the date of birth determined by the Regional Court ("1 January 1953") would have to be adopted in the present proceedings without being reviewed.<br />
<br />
60 <br />
As a legal basis for a recognition of the Turkish judgment in the present case, in accordance with the above (under bb)) Said §§ 108 FamFG into consideration. These special statutory provisions supersede § 328 of the Code of Civil Procedure, since the judgment of the Regional Court of Kayseri, if it had been rendered in Germany, would have been a matter within the scope of application of the Personenstandsgesetz and the Gesetz über das Verfahren in Familiensachen und in die Angelegenheiten der freiwilligen Gerichtsbarkeit (see § 48, § 51.1 sentence 1 PStG in conjunction with §§ 108 f. FamFG).<br />
<br />
61 <br />
Pursuant to Sec. 108 (1) FamFG, foreign judgments are generally recognized except for judgments in matrimonial matters, without any special procedure being required. However, recognition is excluded in the cases mentioned in § 109 FamFG. This is the case, inter alia, if recognition of the decision leads to a result which is obviously incompatible with fundamental principles of German law, in particular if recognition is incompatible with fundamental rights (§ 109.1 No. 4 FamFG, the so-called ordre public reservation).<br />
<br />
62 <br />
Contrary to the view of the defendants, recognition of the judgment of the Kayseri Regional Court of 15 September 2014 is not excluded by the public policy reservation (a). However, the recognition of this judgment does not lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered correct there would have to be adopted for German law without being checked (b).<br />
<br />
63 <br />
(a) The public policy reservation does not preclude recognition of the judgment of the Kayseri Regional Court of 15 September 2014.<br />
<br />
64 <br />
A foreign judgment is not already incompatible with this reservation if the German judge - had he made the decision for recognition - would have reached a different conclusion on the basis of mandatory German law. The foreign decision is also not, in principle, to be reviewed as to its legality against the standard of foreign law (so-called prohibition of révision au fond). The decisive factor is rather whether the result of the foreign decision is in such a strong contradiction to the fundamental ideas of the German regulations and the ideas of justice contained therein that it appears unacceptable according to the German view. The yardstick for review is above all the fundamental rights. A violation of the ordre public can also result from the procedure preceding the decision to be recognised, i.e. the way in which it came about. This is the case if the foreign decision was issued on the basis of proceedings that deviate from the fundamental principles of German procedural law to such an extent that under German law it cannot be regarded as having been issued in orderly proceedings under the rule of law (so-called procedural ordre public, see BVerwG, Urt. v. 29.11.2012, loc. cit.; OVG Bln.-Brbg. 12 July 2017, op. cit.; OVG NRW, judgment of 14.07.2016, op.cit.; NdsOVG, judgement of 29.09.2014, loc. cit.; see also BGH, judgment of 11 April 1979 - IV ZR 93/78 -, NJW 1980, 529; KG Berlin, decision of 1 August 2013 - 1 W 413/12 - StAZ 2013, 348; Völker, Zur Dogmatik des ordre public, 1998, p. 140 et seq.)<br />
<br />
65 <br />
Measured against these restrictive - i.e. recognition-friendly - standards (cf. Geimer, loc.cit., § 328 margin no. 210: ordre public offence "only in very blatant cases"), it is not apparent that the judgment of the Regional Court of Kayseri of 17 January 2015 would not be capable of recognition from the outset. The fact that the defendant does not consider the assessment of evidence in the judgment to be convincing, because in its opinion the court did not fully grasp the facts of the case and did not assess them convincingly from a legal point of view, is as such irrelevant according to the above, because "simple" violations of the national law of the foreign court are in principle not subject to review and are irrelevant from the point of view of recognition law (see on the fundamental irrelevance of doubts about the assessment of evidence of the foreign court Völker, loc. cit, p. 140 with further references; on the fundamental irrelevance of differences in the law of evidence Geimer, loc.cit., § 328 margin no. 237). Furthermore, it does not constitute a violation of the ordre public reservation if the proceedings before the Regional Court of Kayseri were based on the principle of production, as the defendant claims. This would also not per se lead to the result that the court proceedings cannot be regarded as having been conducted in an orderly manner under the rule of law (see on minimum procedural standards such as the requirement of the right to be heard Geimer, loc. cit., § 328 marginal no. 218; on the compatibility of even summary court proceedings with the ordre public reservation Völker, loc. cit.) Rather, serious violations of formal or substantive law or substantive results that make the judgment appear unacceptable according to the German view would have to be added. The defendant has not submitted any arguments in this regard and nothing else is apparent.<br />
<br />
66 <br />
(b) Acknowledgment of the judgment of the Regional Court of Kayseri of 15 September 2014 does not, however, in the present case lead to the legal consequence claimed by the plaintiff that the defendant or the Senate would be bound by the statements in the judgment in such a way that the date of birth considered to be correct there would have to be adopted for German law without verification. A recognition under § 108.1 FamFG has no such effect.<br />
<br />
67 <br />
If the conditions for the recognition of a foreign judgment are met, this means that the objective content and subjective scope of the judgment are extended to the domestic territory (so-called theory of extension of effects, cf, § 328 marginal no. 4, 160; Spellenberg, in: Staudinger, BGB (2005), § 328 ZPO marginal no. 121 et seq.; Stadler, loc.cit., § 328 marginal no. 2; in each case with further details also on the so-called theory of equality, which is decisive according to the loc.cit.) In principle, all procedural effects of a court ruling under the law of the state of origin are recognisable (see Gottwald, loc.cit., § 328 marginal no. 4, 164 et seq.; Spellenberg, loc.cit, marginal 121 et seq. with further references), including, where appropriate, the effect of the decision on the form, legal force (declaratory judgment), exclusion and elements of the offence (cf. Spelling, loc.cit., § 328 ZPO marginal 132 et seq.; Geimer, Internationales Zivilprozessrecht, 7th ed., marginal 2799). Insofar as the effects of the foreign decisions are extended to domestic law, the correctness of the foreign decision - i.e. the correctness of its factual and legal findings - may not be reviewed in Germany because of the extension of its substantive legal force (prohibition of the révision au fond, see above under (a) and BVerwG, judgment of the Federal Administrative Court (BVerwG), para. 29.11.2012 - 10 C 4.12 - BVerwGE 145, 153; OVG NRW, judgment of 14.07.2016 - 19 A 2/14 - FamRZ 2016, 2130; Geimer, loc. cit., § 328 margin no. 208; Gottwald, loc. cit., § 328 margin no. 116 f., 164), unless there is an exceptional violation of the so-called ordre public, i.e. the foreign judgment obviously contradicts fundamental domestic ideas about minimum requirements of legal protection or about the fundamental values of the legal system (cf. Gottwald, loc.cit., § 328 marginal no. 117).<br />
<br />
68 <br />
However, the concrete scope of the effect of recognition in this context is determined in each individual case by the effects which the foreign forum settles in its judgment under its own law. Recognition does not give the foreign judgment any effects beyond those which it has under the law of the first state (Gottwald, loc.cit., § 328 marginal no. 4, 160 with further references). The limitation of the extension of effect to the extent of the effect in the foreign law also applies with regard to the subjective limits of the legal force. In principle, this extends only to the parties to the foreign proceedings. Whether or not a judgment exceptionally has a binding legal effect vis-à-vis third parties also depends in principle on the law of the country in which the judgment was given (see Spelling, loc.cit., § 328 marginal no. 155 ff.). Such third-party obligations are to be interpreted in accordance with §§ 325 et seq. 325 et seq. ZPO, such third party obligations must as a rule be recognised if the third party is the legal successor of a party and has consented to the conduct of the proceedings abroad. Otherwise, a third party can only be bound if he has been granted a legal hearing in the foreign court proceedings, because this guarantee is part of the German ordre public (see again § 109 para. 1 no. 4 FamFG and on the identical content of § 328 para. 1 no. 4 ZPO Gottwald, loc. cit.)<br />
<br />
69 <br />
According to these principles, decisions of foreign courts which - as in the present case - order the correction of a foreign register of civil status are not recognisable in the sense that the information determined by the foreign court as having to be entered in the register would have to be adopted in official or even judicial proceedings in Germany without being checked. For the effect of such a foreign correction judgment is limited to the correction of the foreign register (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240), in other words in the decision on the question of whether the respective foreign registrar is obliged to change the entry in the register of civil status there (VG Berlin, Urt. v. 16.11.2018 - 4 K 486.17 V - InfAuslR 2019, 98; OLG Düsseldorf, decision of 09.05.199 - 3 Wx 261/96 - StAZ 1997, 276). A possible recognition of the Turkish court decision ordering the correction of the entry of the date of birth therefore only means that the correction of the register or the obligation of the competent foreign authority to make the correction is recognised, but not at the same time that the date of birth deemed to be correct by the Turkish court would be binding on German authorities and courts (BVerwG, decision of 9 August 1990 - 1 B 103.900-, Buchholz 310 § 98 VwGO marginal no. 35). The foreign judgment is therefore of no further significance than the corrected entry itself - unless the operative part of the decision exceptionally provides for something more far-reaching in the respective individual case. This entry, however, in turn serves merely as evidence in establishing the correctness of the certified fact (Geimer, loc.cit., marginals 2800, 2845, 2860) and does not have any irrefutable effect or binding effect in court proceedings (see BVerwG, decision of 9 August 1990, loc.cit.; on the significance of entries in foreign registers of civil status for German court proceedings, see cc)). Even foreign judgments concerning the correction of the entry in the foreign civil status register as of the date of birth cannot, according to the above-mentioned comments on the right of recognition, establish a binding effect in such a way that the date of birth assumed to be correct in the foreign judgment would have to be bindingly adopted in German court proceedings without any examination of its own (see BVerwG, decision of 9 August 1990, loc.cit.; VGH Bad.-Württ. 22.10.1987, loc. cit.; Geimer, loc. cit., margin no. 2800 with further details; VG Berlin, judgment of 16.11.2018, op. cit.; in the same result, but based not on the theory of extension of effects, but on the theory of equality VG Stuttgart, decision of 18.08.1981 - VRS 7 K 395/81 - StAZ1982, 218; Rumpf, StAZ 1990, 326 <327>).<br />
<br />
70 <br />
There is therefore no need for further explanation as to whether the limits of the subjective legal force of the Turkish judgment may also stand in the way of a binding effect in the sense alleged by the plaintiff in the present individual case, since the defendant was neither involved in the Turkish court proceedings nor able to express itself in them. Likewise no further explanations are required for the fact that the binding effect alleged by the plaintiff might fail independently of it also then because of the recognition-legal principle of the extension of effect, if one assumes that the Turkish right does not attach any binding effect to a correction judgement of the kind in question here even within the Turkish legal system in the sense that the correctness of the new entry might not be examined any longer (see BVerfGE 101, 286 (3)). Rumpf, StAZ 1990, 326 <328>, according to which a corrected registration also in Turkish law only assumes the function of documentary evidence and does not release the courts there from the obligation to investigate allegations of incorrectness of the registration).<br />
<br />
71 <br />
cc) The Senate is also not bound by international treaties (1) or simple statutory national provisions (2) to the current entry of the plaintiff's date of birth in the Turkish civil status register or to the register extract submitted by the plaintiff in the sense that it would have to adopt the last date of birth ("01.01.1953") mentioned in the register and the extract without checking it.<br />
<br />
72 <br />
(1) In particular, such binding effect does not result from the "Convention on the Issue of Multilingual Extracts from Civil Status Books" of 8 July 1976 (Federal Law Gazette II 1998, p. 966, hereinafter: CIEC Convention No. 16) referred to by the plaintiff.<br />
<br />
73 <br />
In the Convention, the Contracting Parties agreed that extracts from civil status registers, particularly if they are intended for use abroad, should be issued on the basis of certain more precisely defined forms and in compliance with certain standards of form (cf. Preamble and Articles 1, 3 to 6 and 8, first sentence, of the Convention) and that they should be drawn up on the basis of the original entries and subsequent endorsements in the civil status registers (cf. Article 2 of the Convention). The Convention also stipulates that extracts drawn up in accordance with its provisions "shall have the same force as extracts drawn up in accordance with the national legislation of the State concerned. They shall be accepted without legalisation, certification or equivalent formality in the territory of any State bound by this Convention" (Article 8, second and third sentences, of the Convention).<br />
<br />
74 <br />
The latter means that excerpts which meet the requirements of the Convention are equivalent to the civil status documents mentioned in § 55.1 PStG - including birth certificates (§ 55.1 no. 4, § 59 PStG) - and are to be recognised by a registrar without legalisation or equivalent formality (see Bornhofen, in: Gaaz/Bornhofen, Personenstandsgesetz, 3rd ed., § 54 marginal 19, § 59 marginal 33 f.; Berkl, Personenstandsrecht, marginal 1144). However, it does not follow from Article 8 of the Convention, as the plaintiff submits, that the defendant, as the registration authority, or the Senate would be obliged to adopt the information in the extract from the Turkish register of civil status submitted by the plaintiff (Annex K 3, "Nüfus Kayıt Örneği" of ..., pp. 103 f. d. VG-Akte) without checking it.<br />
<br />
75 <br />
CIEC Convention No 16 does not go further in the present case, if only because the applicant has not submitted an 'extract from a register of civil status' within the meaning of the Convention. For the extract submitted by him was not drawn up on the multilingual form of the Convention (see Article 6 of the Convention). The extract therefore does not benefit from the exemption from formalities regulated in Article 8 sentence 3 of the Convention (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240). Since the extract from the register is not provided with a legalisation or apostille, not even the presumption of the authenticity of the document from § 98 VwGO in conjunction with § 437 Paragraph 1, § 438 Paragraph 2 ZPO and the Hague Convention on the Exemption of Foreign Public Documents from Legalisation of 05.10.1961 (BGBl. 1965 II, p. 876). The authenticity and a fortiori the question of the correctness of the content of the extract must therefore be assessed by way of the free assessment of evidence (see BayVGH, decision of 21 August 2019 - 5 ZB 18.1226 - juris and VG Würzburg, judgement of 5 March 2018 - W 7 K 18.258 - juris).<br />
<br />
76 <br />
In any event, even if the extract from the register were to comply with the formal requirements of CIEC Convention No 16, the link alleged by the applicant to the content of the extract would not be established. According to the second sentence of Article 8 of the Convention, such extracts have, as has been shown, 'the same force as extracts issued in accordance with the national legislation of the State concerned'. However, not even notarisations in the registers of civil status and civil status certificates drawn up under German law (§ 55.1 PStG) have the "binding effect" desired by the plaintiff. A birth certificate (§ 55, Subsection 1, No. 4, § 59 PStG) does in principle prove the place and date of birth (see § 54, Subsections 1 and 2 in conjunction with § 59, Subsection 1, No. 3 PStG). However, this does not change the fact that the underlying entries do not have a constitutive effect and that under § 54.3 PStG proof of incorrectness is admissible (see VGH Bad.-Württ. 22.10.1987 - 11 S 1827/87 - ESVGH 38, 45; BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253). This applies to a German civil status document even if the incorrect data entered are based on a court order (see VGH Bad.-Württ. 22.10.1987, loc.cit.; Bornhofen, loc.cit., § 54 marginal 23 with further references on the admissibility of a so-called "rectification"; Berkl, loc.cit., marginal 18). Even an extract from a foreign - in this case Turkish - register of civil status cannot therefore establish a binding effect in the sense that the German authorities would be bound by the content of this declaration without the possibility of a review. If a registrar has doubts about the correctness of an entry, he must - as with entries made solely under national law - initiate his own investigations in accordance with the principle of official investigation (see Berkl, loc.cit., marginal no. 18; BSG, Urt. v. 13.10.1992 - 5 RJ 16.92 - BSGE 71, 170). Accordingly, the above-mentioned Convention does not restrict the evidence for court proceedings (see OLG Hamm, order of 16 March 2004 - 15 W 45/04 - StAZ 2003, 296 on § 47 PStG; see also Berkl, loc.cit., marginal no. 1144 on the reduction of the evidential value of foreign civil status excerpts solely by the passage of time). These principles, which are decisive for the procedure of the registry offices, apply all the more to the storage of data by - as here - the registration authorities. If the registration authorities have concrete indications of the incorrectness or incompleteness of the register of births, marriages and deaths of a person, they are obliged to investigate the facts of the case ex officio in accordance with § 6 para. 3 of the Federal Law on the Civil Register (new version, also already § 6 para. 3 of the Federal Law on the Civil Register, old version).<br />
<br />
77 <br />
(2) Even beyond the provisions of the said Convention, national law does not impose any obligation on the content of the entry in the Turkish civil status register or of the extract from that register submitted by the claimant. In particular, the provisions on the probative force of the domestic civil-status registers and documents (see again § 54 of the PStG), which apply to domestic registers and documents, do not convey any such binding effect - even beyond the probative force of German registers and documents. The content of foreign deeds is also subject to free judicial assessment of evidence from the point of view of simple national law (see BSG, Urt. v. 29.11.1985 - 4a RJ 9/85 -, SozR 2200 § 1248 no. 44; LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240; Hull, StAZ 1990, 326 <328>).<br />
<br />
78 <br />
dd) The provisions of Art. 5 of the Introductory Act to the Civil Code referred to by the plaintiff likewise do not establish any connection with the date of birth last established by a court in Turkey and registered there under civil law.<br />
<br />
79 <br />
Art. 5 EGBGB, which governs the so-called personal statute, stipulates in paragraph 1 that, where reference is made to the law of the country to which a person belongs and he belongs to several countries, the law of the country with which the person is most closely connected, in particular by his habitual residence or by the course of his life, is to be applied and that, if the person is also German, this legal status takes precedence.<br />
<br />
80 <br />
This provision is contained in the first section of the second chapter of the Introductory Act to the Civil Code, which regulates "general provisions". This second chapter regulates private international law. The task of private international law is to determine the private law system applicable to the respective situation in private law cases involving foreign countries (see Article 3 of the Introductory Act to the Civil Code) (Lorenz, in: Bamberger/Roth/Hau/Poseck, BeckOK BGB, Einleitung zum Internationalen Privatrecht, marginal no. 1; Dörner, in: Schulze, BGB, 10th ed, Preliminary remark on Articles 3 to 6 EGBGB, marginal 1; Hailbronner, in: Hailbronner/Maaßen/Hecker/Kau, Staatsangehörigkeitsrecht, 6th ed., Part I.C., marginal 1 f.). Within private international law, however, Article 5 of the Introductory Act to the Civil Code is not an independent conflict-of-law rule - i.e. not a rule which refers to another legal system as a legal consequence for a legal area defined in its facts (see, for example, Article 10 of the Introductory Act to the Civil Code in respect of the right to a name and Article 19.1 sentence 1 of the Introductory Act to the Civil Code in respect of the right of descent, see OVG NRW, Urt. v. 14 July 2016 - 19 A 2/14 - FamRZ 2016, 2130). Art. 5 EGBGB is merely a so-called conflict-of-law auxiliary provision. Such an auxiliary provision can only come into effect if another provision of national law refers to foreign law (see Lorenz, loc.cit., introduction, marginal 33 et seq., and Article 5 marginal 1). Domestic substantive law, which contains special provisions for foreigners and situations involving foreign relations, must also be distinguished from the entire body of private international law. This so-called foreigners' law does indeed regulate - to the same extent as private international law - matters with a foreign connection. However, it does not contain any rules on referrals, but rather substantive rules which somehow relate to a foreign fact, which in turn presuppose the applicability of German law. This foreigners' law - as for example in the Residence Act - is largely to be found in public law (Lorenz, loc. cit., marginal no. 11).<br />
<br />
81 <br />
On this basis, the plaintiff's reference to Article 5 EGBGB is void. Neither the Federal Registration Act itself nor other provisions of German public law refer to the law of the state to which the foreigner belongs in order to determine the date of birth of a foreigner residing in Germany for the purposes of German registration registers.<br />
<br />
82 <br />
ee) If, according to the above, the Senate is not bound by the date of birth "1 January 1953", which is last used by Turkish authorities as a basis, it must be decided by way of a free assessment of evidence whether the entry in the defendant's register of residents ("1 January 1958") which deviates from this is objectively incorrect in the above sense and whether the year of birth ("1953") stated by the plaintiff is objectively correct. This evaluation of the evidence shows that, although there is some evidence to support the incorrectness of the year of birth ("1958") recorded by the defendant in the plaintiff's register of residents, there is no evidence to convince the Senate that the year of birth which the plaintiff requests to be recorded ("1953") is objectively correct.<br />
<br />
83 <br />
The information provided by the plaintiff in the oral hearing of the Senate provides indications that the change of the year of birth from "1956" to "1958" in the Turkish civil status register, which was initiated in 1971 by the Local Court Sarız upon application of the plaintiff's father, was not based on the fact that the plaintiff was actually born in 1958. The plaintiff stated that he did not know why this change had been made. However, he stated - in this respect credibly - that his parents had repeatedly explained to him that he was in fact born earlier than in 1958. He also explained in essence that he considered it possible that the change at that time had been made with a view to his departure for Germany and in order to avoid being called up for military service in Turkey. In particular, the latter assessment did not appear to be alien to life. However no sufficient indications for the formation of a conviction certainty result from the data of the plaintiff for the fact that he is born straight in the year 1953. He did indeed state that his father in particular had also informed him of this. However, the Plaintiff was not able to explain why his parents should then have registered him in 1959 with the civil status register from the outset with an incorrect birth cohort ("1956"). There are also no other comprehensible reasons for this. Further doubts as to the validity of the - assumed - declaration of the plaintiff's father on his exact year of birth arise from the fact that the father was also prepared, in the plaintiff's analogous assessment, to deliberately make false statements in court proceedings - the proceedings before the Local Court Sarız conducted in 1971.<br />
<br />
84 <br />
The statements of the witness ..., the plaintiff's wife, heard by the Senate, offer no starting point for further persuasion of the Senate. The testimony heard at the... born on ..., has essentially stated that her family and that of the plaintiff are related, that she met him in about 1964, that she was told at that time that he was two or three years older than she was, and that it also corresponded to her impression that he was older than her. The weight of this statement is, however, already considerably diminished by the fact that the Senate has gained the impression that the witness's testimony had been agreed between her and her husband in advance. Thus, the witness made her statement on the difference in age at the beginning of the interrogation on the merits of the case on her own initiative, although the Senate had not asked any question to this effect until then, but had inquired as to when the witness had met the Plaintiff. In response to inquiries by the Senate at the time when the plaintiff had suffered injuries to his hand, the witness changed her testimony at the hearing, in the Senate's impression, under the influence of the plaintiff, and contested this change despite the plea of censure. Irrespective of the resulting doubts as to the credibility of her testimony, the witness was also unable to provide any information in terms of content that would allow the assumption with sufficient certainty that the plaintiff was born in a particular year (1953). Her statements remained vague, both with regard to the statements of third parties ("two or three years") and with regard to her own perception ("a little older").<br />
<br />
85 <br />
The statements of the witness questioned by the senate... ...do not allow the Senate to be further persuaded. The witness... born on ..., essentially stated in a general sense that at an age that he estimated to be 7 or 8 years old on account of his progress in Quranic instruction at the time, one day after attending Quranic school he met his mother who was preparing food. She told him that the "sister..." - the plaintiff's mother - had a son. The Senate was already not able to convince itself of the credibility of the witness's testimony in the sense that it could therefore concretely remember the birth of the plaintiff. At the same time, the witness stated that 40 to 50 families lived in the village in question and that it was a tradition to bring food as a gift to the families concerned at each birth and similar events. Against this background, the witness was not able to explain the question that arose as to why the plaintiff, in view of the large number of these events, was able to remember the birth of the plaintiff in his, the witness's, early childhood. Rather, he repeatedly evaded the Senate's repeated inquiries to this effect.<br />
<br />
86 <br />
In the context of this necessary assessment of evidence, the Senate must also take into account the findings of the foreign courts, the amended entries in the foreign civil status register - in the present case based on the decision of the Kayseri Regional Court - and the information in the foreign register. However, all these details are subject to the free assessment of evidence because they are not binding (see BVerwG, decision of 9 August 1990, loc. cit., and Geimer, loc. cit. 13.10.1992 - 5 RJ 16/92 - BSGE 71, 170 and of 29.11.1985 - 4a RJ 9/85 - StAZ 1986, 253 and LAG Schl.-Holst. 12.04.1989 - 5 Sa 40/89 - BeckRS 1989, 30816240, on corrections to foreign civil status registers; above under (1) on information in a ).<br />
<br />
87 <br />
In the present case, the findings of the District Court of Kayseri in its judgment of 17 January 2015 offer further evidence which, like the information provided by the plaintiff, speaks for the incorrectness of the plaintiff's year of birth ("1958") stored by the defendant. For example, the plaintiff's sister, who was heard as a witness by the Regional Court and who, according to his statements, ... According to the grounds of the judgment, the plaintiff's sister, who according to her own statements was born ..., stated that she was 6 to 7 years old when the plaintiff was born. According to the records, there are no discernible doubts about the witness' credibility. Contrary to the defendant's insinuations in this regard, they do not arise solely because of the relationship between the witness and the plaintiff. Overall, the Senate has no reason to doubt that the witness testified subjectively true, that is, that she stated what she thought she remembered. However, even the statements of this witness do not permit the conclusion with sufficient certainty that the Plaintiff was born in 1953. The weight of the witness's testimony is already considerably reduced by the fact that the witness had to fall back on memories from her early childhood on the one hand, and on the other hand could only give an approximate indication herself (6 or 7 years), which does not allow a definite conclusion to be drawn about a particular year of birth. In addition, the assumption that the witness is ... born - and thus the calculation of the plaintiff's date of birth based on this assumption - is also doubtful. The Regional Council and the defendant rightly pointed out that the reliability of the assumption that the sister is ... born, appears doubtful in view of the year of birth of the plaintiff's mother (...) and in any case per se does not provide a sufficient basis for the formation of a secure certainty of conviction.<br />
<br />
88 <br />
A further indication for the incorrectness of the plaintiff's date of birth ("1 January 1958") recorded by the defendant, but again not for the correctness of the year of birth 1953, is provided by the testimony of the witness ....who had been heard by the Regional Court Kayseri (meanwhile deceased). When he (the witness) in ... the plaintiff was born. This had been in 1952 or 1953. The weight of this statement is relativized by the fact that the witness did not explain why he had even closer memories of the plaintiff's birth. Irrespective of this, the witness only made an approximate statement (1952 or 1953), which does not allow a definite conclusion to be drawn about a particular year of birth.<br />
<br />
89 <br />
The letter from a hospital, which is further referred to in the judgment of the Kayseri Regional Court, does not go much further for the reasons already stated in the notice of opposition. Irrespective of the unclear date of examination and issue, the large age range (50 to 60 years) mentioned in the letter alone does not allow any conclusion to be drawn as to a specific year of birth.<br />
<br />
90 <br />
The considerations regarding the enrolment of the plaintiff in school, which were presented by the plaintiff's attorney at the time in the proceedings before the Regional Court of Kayseri, also tend to speak against the correctness of the date of birth registered by the defendant (1 January 1958), but also do not allow a reliable conclusion to be drawn - in particular regarding an objectively correct birth cohort. According to the entries made since 1959, the plaintiff could have been born in 1953, 1956 or 1958. He would then have been approximately 8.5 or 5.5 or 3.5 years old at the beginning of the 1961/62 school year. On this basis, the date of birth (1958) registered by the defendant appears improbable, but the date of birth last asserted by the plaintiff (1953) also appears to be improbable, and speaks a lot for the approximate correctness of the first entry in the Turkish register of civil status (1956), which was made in 1959. However, it must be taken into account that entry into the school does not provide proof of the actual date of birth of the pupil. This applies all the more so because, as the Regional Council also rightly pointed out in the notice of opposition, in Turkey, at any rate as late as the middle of the last century, there were in some cases considerable age differences in school enrolment (see BayLSG, judgment of 5 August 2009 - L 14 R 65/08 - juris). In the oral hearing, the plaintiff confirmed these uncertainties in substance by stating that initially there was no school in his village and that the start of school for an entire year had been postponed.<br />
<br />
91 <br />
The findings of the Kayseri Regional Court lose further weight because the court did not deal with the findings of the Local Court Sarız which were different and more closely substantiated. The findings of the Local Court are of particular importance in the necessary overall consideration of all circumstances because, according to the reasons for the ruling of 16 June 1971, the court observed the plaintiff itself and assessed his behaviour, his condition and his physical appearance. This observation was made at a point in time that was even significantly closer to the plaintiff's birthday than the judgment of the Kayseri Regional Court in 2015. The plaintiff was approximately 18.5 or 15.5 or 13.5 years old in 1971, based on the birth cohorts 1953, 1956 and 1958. It seems unlikely, as the Regional Court has correctly pointed out, that the court could have "officially" considered the plaintiff, who was approximately 15.5 years old in 1971, to be two years younger if he had actually been three years older. In any case, the findings of the Regional Court at that time speak with considerable weight against the assumption that the plaintiff was born precisely in the year 1953.<br />
<br />
92 <br />
The photographs submitted by the plaintiff in the administrative court proceedings also do not allow a definite conclusion to be drawn about a certain age. According to him, the pictures of his wedding were taken from the ....He was at that time approximately 22 or 19 or 17 years old, measured by the birth cohorts 1953, 1956 and 1958. In these pictures he probably appears older than 17 years. Certainly this conclusion cannot be drawn from the pictures. In any case, they offer no evidence for the assumption that the plaintiff was born in 1953.<br />
<br />
93 <br />
Even when the circumstances previously assessed are taken together, the available evidence is in any case not able to provide the Senate with the full certainty of conviction that the year 1953, last named by the plaintiff as the year of birth, is objectively correct. That the year of birth stored by the defendant ("1958") is objectively incorrect is possible and, in view of the year of enrolment and the wedding photographs submitted, also probable. However, in view of the statements of the Local Court Sarız on the observation of the plaintiff, it is in any case not certain, as required, "with a probability bordering on certainty" (see BVerwG, judgment of 28 April 2011 - 2 C 55.09 - juris) that the year of birth ("1953") last alleged by the plaintiff is correct ("non liquet", see BVerwG, judgment of 28 April 2011, loc. cit.)<br />
<br />
94 <br />
4. no further measures are available or cannot be taken to clarify the facts concerning the correct year of birth of the claimant.<br />
<br />
95 <br />
The only further measure to investigate the facts of the case is to have the plaintiff's sister, the woman resident in Turkey, who was already heard by the Kayseri District Court in 2015, heard again on a request for judicial assistance. In accordance with § 244.5 sentence 2 VwGO (German Rules of the Administrative Courts), the Senate will refrain from this - after having heard the parties involved who have not raised any objections to this.<br />
<br />
96 <br />
According to the provision of § 244, Subsection 5, Sentence 2, StPO, which is applicable mutatis mutandis in administrative proceedings, an application for the taking of evidence by a witness whose summons would have to be effected abroad can be rejected if, in the court's dutiful discretion, it is not necessary to investigate the truth (see BVerwG, Urt. v. 29.03.2012 - 2 A 11.10 - Schütz BeamtR ES/B II 1.1 No. 26). According to the case-law of the Federal Court of Justice, which the Federal Constitutional Court has approved (Chamber Order of 21 August 1996 - 2 BvR 1304/96 - NJW 1997, 999 f.) and which the Federal Administrative Court has endorsed (see BVerwG, judgement of 29 March 2012, loc. cit.), it is decisive for the application of § 244.5 sentence 2 StPO whether the collection of the (possibly requested) evidence is a requirement of the duty of disclosure (BGH, judgement of 18.01.1994 - 1 StR 745/93 - BGHSt 40, 60; decision of 05.09.2000 - 1 StR 325/00 - NJW 2001, 695). The judge is allowed and ordered to base the taking of evidence on the previous result. The prohibition of anticipation of evidence, which otherwise largely prevails in the law on the submission of evidence, does not apply here. The decision on the request for evidence may be made dependent on the results to be expected from the taking of evidence and how these expected results would be assessed (BVerwG, Urt. v. 29.03.2012, loc. cit., and decision of 20.05.1998 - 7 B 440.97 - Buchholz 428 § 1 VermG No. 153). Decisive factors are the significance and probative value of the further evidence against the background of the previous evidence, the time and organisational expenditure of the possible taking of evidence and the associated disadvantages due to the delay of the proceedings in compliance with the principle of proportionality (Vierhaus, Beweisrecht im Verwaltungsprozess, 2011, marginal no. 172).<br />
<br />
97 <br />
On this basis, the Senate refrains from re-examining the foreign witness in question. Her testimony is of considerable importance for the plaintiff's claim. In the present individual case, however, it must be taken into account that the Senate already has a written testimony of the witness from the year 2015. As stated above, there are no reasons to doubt her credibility and therefore to conduct a new hearing (in this respect similar to the BVerwG, judgment of 29 March 2012, loc. cit.) In addition, the Senate would not be able to obtain a personal impression of the witness even in the event of a hearing by way of a request for judicial assistance. What substantive results can be expected from the collection of evidence, however, is very likely to be foreseeable. It is not to be expected that the witness could or would express anything different from what she has already stated in 2015 in the event of a new hearing. As shown above, the Senate can assume that the witness at that time testified subjectively true, i.e. she stated what she thought she remembered. The repetition of this statement would in all likelihood not lead to a different evaluation of the evidence. In addition, since there is no basis under international treaty law for judicial assistance in administrative matters between the Federal Republic of Germany and the Republic of Turkey, a request for judicial assistance, as the Federal Foreign Office has confirmed at the request of the Senate, could only be made in so-called non-contractual legal relations. In such a case, according to the experience of the Foreign Office, very long processing times must be expected. In the overall view of all these circumstances, the repeated collection of evidence in Turkey in the present individual case is not a requirement of the duty to clarify.<br />
<br />
98 <br />
(5) The decision on the burden of proof to be taken in accordance with the foregoing is to the detriment of the applicant and leads to the dismissal of the action in the principal claim.<br />
<br />
99 <br />
If the person concerned asserts a right of rectification based on Article 16 sentence 1 DSGVO against the institution of a German registration authority by way of legal action to replace a date entered in the register of residents which in his view is "incorrect" with another date which in his view is "correct", a "non liquet" does not mean that the person concerned has a right to have data processing restricted in accordance with or analogous to Article 18(1)(a) DSGVO (a). Similarly, such a "non liquet" does not result in the data subject having a right to have the date he or she has specified registered by way of "rectification". Rather, in such a case - and thus also here - the action must be dismissed in accordance with the rules on the burden of proof of national law applicable in this respect (b).<br />
<br />
100 <br />
a) With his main claim, the plaintiff pursues the claim to replace the entry in the defendant's register of residents regarding his year of birth ("1958") with the entry "1953" by way of a correction. A condemnation of the defendant to "restrict" the processing of this personal date in accordance with or analogous to Article 18.1 letter a of the DPA would correspond, at most in part, to this claim. In the present case, such a conviction is also out of the question for legal reasons. This is because a "non liquet" to the question of the correctness of a personal date entered in a population register does not - contrary to a view held in the literature - lead to a claim for limitation.<br />
<br />
101 <br />
Article 18 paragraph 1 letter a FADP provides for a special rule in the event that the accuracy of a statement is disputed between the data subject and the controller. According to this provision, the data subject has the right to request the controller to "limit" the processing if the accuracy of the personal data is disputed by the data subject "for a period of time sufficient to enable the controller to verify the accuracy of the personal data". If the processing is restricted in this way, Art. 18 para. 2 DPA stipulates that, for the time being, the personal data concerned - apart from being stored - may be processed only with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.<br />
<br />
102 <br />
However, the federal legislator has excluded the application of Art. 18 para. 1 letter a DSGVO specifically for the field of reporting. § Section 12 sentence 2 of the Federal Act on the Federal Ministry of Health in the version in force since 26 November 2019 provides: "For the duration of the verification of accuracy, the processing of data is not restricted pursuant to Article 18 paragraph 1 letter a of Regulation (EU) 2016/679. This - based on the opening clause in Art. 23(1)(a) - is not applicable to c, para. 2 of the DPA, which is unobjectionable under Union law, is based on the assumption of the legislature that the register of residents "serves the administration, the administration of justice, public religious communities and the public as a basis for information. It is recognised in the highest court rulings that 'the individual cannot completely withdraw from his environment without good reason, but must remain accessible and accept that others - also with state assistance - contact him' (BVerwG, NJW 2006, 3367 et seq.). This function would be endangered if a restriction on processing ('blocking') could be triggered at any time by denying the correctness of a date' (explanatory memorandum to the Federal Government's draft law, BT-Drs. 19/4674, p. 224).<br />
<br />
103 <br />
If, as in the present case, the verification of the accuracy of the personal data to be carried out by the controller in the event of dispute has been completed and has led to a "non liqueur", this does not mean that a permanent "restriction on processing" within the meaning of Article 18(1)(a) DPA is to be imposed (but Ehmann/Selmayr, op. cit., Art. 16 para. 22, and Peuker, in: Sydow, Europäische Datenschutzgrundverordnung. 2nd ed., Art. 18 para. 12, which grants the person responsible the power to add the addition "that the accuracy of the data has been undeniably disputed"). The assumption of a claim to a permanent restriction on processing is not convincing even within the scope of application of Art. 18 DPA. Directly, Art. 18(1)(a) DPA is not relevant, since the processing restriction can only be required "for a period of time which enables the controller to verify the accuracy of the personal data". For an analogy that might be considered here, there is already no loophole in the regulation that is contrary to the plan. For the Union legislature has seen the problem of "controversial data" and has nevertheless only created a provision in Art. 18 DSGVO for the period of time stipulated therein, as is shown by the clear wording of the provision in this respect. The provision therefore does not confer any right to a permanent restriction of data processing (also Paal, loc.cit., Art. 16 marginal no. 15 in connection with Art. 18 marginal 16 in conjunction with Art. 18 DS-GVO; also Worms, loc.cit., Art. 18 DS-GVO; Herbst, in: Kühling/Buchner, loc.cit., Art. 18 DS-GVO marginal 13). All the more so, this view cannot be followed in the case of a claim for correction under registration law, as is the case here. For if the national legislature has already excluded Article 18.1(a) of the DS-GVO in a manner permissible under Union law for the temporary period of the examination by the registration authority, no permanent "right of limitation" can be derived from this provision within the scope of the Federal Registration Act.<br />
<br />
104 <br />
(b) The 'non liquet' relating to the question of the correctness of the year of birth of the applicant entered in the register of residents does not mean that the applicant is entitled to have the date of birth stated by him as correct but not proven to be correct.<br />
<br />
105 <br />
To the extent that a different opinion is expressed in the Union law literature on Article 16 DSGVO, the Senate does not share this view. Some of the literature refers to Article 5.1 DSGVO, which regulates the "principles governing the processing of personal data" and stipulates that personal data must be processed "in a lawful manner" (letter a) and "factually correct" (letter d). With the argument that Article 5(1) DPA constitutes a prerequisite for the processing of data by a controller, it is argued that the absence of a legal basis generally leads to the unlawfulness of data processing. In other words, a "non liquet" with regard to the accuracy of the data means a "non liquet" with regard to the principle of data accuracy under Article 5.1(d) DPA, and in this case there is no proof of the existence of a sufficient legal basis for the data processing, which is why the further processing of data which cannot be proven to be correct is unlawful (Herbst, in: Kühling/Buchner, loc. cit, Art. 18 DS-GVO marginal 13; in principle also Spindler/Dalby, in: Spindler/Schuster, Recht der elektronischen Medien, 4th ed., Art. 18 DS-GVO marginal 4). This would result in a "right of cancellation or correction" (Worms, loc.cit., Art. 18 marginal 35; Gola, loc.cit., Art. 18 marginal 13), whereby the person concerned would be free to choose between cancellation (cf. Art. 17(d) DS-GVO) and "correction" (Gola, loc.cit, Art. 18 marginal 13; unclear in this respect Worms, loc. cit., Art. 18 marginal 35, and Herbst, in: Kühling/Buchner, loc. cit., Art. 18 DS-GVO marginal 13). Anything else should apply only in the exceptional case that the person concerned alone has relevant evidence and does not produce it despite the possibility. In this special case, the burden of proof would exceptionally lie with the person concerned and his or her conduct might be at his or her expense (see Worms, loc. cit., Art. 18 DS-GVO nr. 36, and the following, loc. cit, § 58 BDSG marginal no. 38; similar for the case that the data subject only "unsubstantiated" denies the correctness of the data, Spindler/Dalby, loc. cit., Art. 18 DS-GVO marginal no. 4; VG Stade, decision of 9 October 2018 - 1 B 1918/18 - NVwZ 2019, 251).<br />
<br />
106 <br />
The Senate does not share the view that when a claim for rectification is asserted, the burden of proof should in principle lie with the processor of the data (here: the institution of the registration authority), irrespective of the subject of the dispute and the procedural situation, and that the person concerned should be able to claim either "rectification" or "deletion".<br />
<br />
107 <br />
Insofar as the data subject is granted a right to "rectification" in the case of a "non liquet", this is already opposed by the fact that, even within the scope of application of the Data Protection Basic Regulation, data can, as shown, only be "rectified" by bringing them into conformity with reality (see above under 3.b and again in this respect also Worms, loc.cit., Art. 16 marginal no. 61; Herbst, in: Kühling/Buchner, loc.cit., Art. 16 DS-GVO marginal no. 18). If, however, there is a "non liquet" and the objective accuracy of the date which the data subject wishes to have stored or otherwise processed is therefore also not certain, the storage of this date cannot conceptually constitute a "correction" (the same conclusion applies to § 12 BMG old version BVerwG, judgement of the Federal Administrative Court, para. 30.09.2015, op. cit., and Senate, resolution of 07.03.2016, op. cit.: no claim to replace an incorrect entry with another, likewise incorrect entry, because such an entry would not correct the register of residents, i.e. correct it in terms of reporting law, but rather update its incorrectness).<br />
<br />
108 <br />
Therefore, the only possible claim for deletion due to "unlawful data processing" (see Article 17 (1) (d) DSGVO and Section 14 (1) BMG n.F.). As a rule, however, such a claim - and thus also in the present case in relation to the plaintiff's main claim - does not correspond to the request of the data subject. For if a data subject asserts the "correction" of a data processing operation on the basis of Article 16 sentence 1 DPA, he or she requests the replacement of a date which he or she considers to be incorrect by another date which he or she considers to be correct in the data processing of the data controller. Measured against this request for correction, the deletion of the date stored up to that point is an aliud.<br />
<br />
109 <br />
Irrespective of this, the relevant principles of the distribution of the burden of proof within the scope of application of Art. 16 sentence 1 DSGVO argue against the assumption that a "non liquet" is at the expense of the processor (in this case the registration authority) in the case of a claim for correction based on Art. 16 DSGVO. In the Basic Data Protection Regulation, the Union legislature has laid down specific rules on the burden of proof (see Article 57.4 sentence 2 DSGVO: Refusal of information in the case of "manifestly unfounded or excessive" requests). This is not the case for the element of the offence of "incorrectness" within the meaning of Article 16 DSGVO. Insofar as Union law does not establish its own rules on the burden of proof, it is in principle for the national judge to apply the provisions of his own legal system in this respect and in so doing "only" to ensure that their application does not impair the effectiveness of Union law (see ECJ, judgment of 3 October 2013 - C-113/12 - UPR 2014, 61 with further references). Therefore, the general rules on the burden of proof under national law, in particular under German administrative procedural law, also apply to the examination of whether a person affected can assert a claim for correction or cancellation against a reporting authority. According to these, the general rule of evidence applies to the formation of judicial conviction, namely that the unprovable nature of facts from which a party derives favourable legal consequences for it is in principle at its expense (see BVerwG, decision of 26 July 2016 - 8 B 2.15 - juris, and of 30 June 2014 - 8 B 94.13 - ZOV 2014, 174).<br />
<br />
110 <br />
It follows from this that it cannot be concluded, undifferentiated and detached from the specific subject of the dispute and the administrative procedural situation for all areas of application of Art. 5, 16, 17, 18 DPA, that the burden of proof for the accuracy or inaccuracy of data or the lawfulness or illegality of data processing lies with the data subject or the person responsible. Rather, a distinction must be made in each individual case according to who is actually pursuing which substantive claim against whom and who, in the specific situation, wishes to derive a legal consequence favourable to him from which facts. If a data subject - such as the plaintiff here - asserts a claim against the processor on the basis of Art. 16 sentence 1 DSGVO for "correction" of "incorrect" data (or, if applicable, alternatively a claim for deletion of data due to "unlawful data processing"), it is the data subject who wishes to derive a legal consequence favourable to him from the cited facts. In this concrete procedural and procedural situation, the burden of proof for the existence of the aforementioned conditions for a claim rests with the data subject (in the same way Paal, loc.cit., Art. 16 DS-GVO, marginal 15; Laue/Kremer, das neue Datenschutzrecht in der betrieblichen Praxis, 2nd ed., § 4 marginal 38).<br />
<br />
111 <br />
Nor does the application of national rules on the burden of proof constitute an infringement of the principle of effet utile under Union law. The effectiveness of Union law is sufficiently safeguarded here by national procedural law. In German administrative procedural law, the party concerned receives special protection in the event of disputes on factual issues, in particular by the fact that the requirement of official investigation applies instead of the principle of submission (see § 24.1 and 2 of the Law on Administrative Procedure (LVwVfG), § 86.1 of the Code of Administrative Procedure (VwGO)). The rules on the burden of proof only come into effect here - also in the right to register - if not only the applicant has reached the end of his possibilities of investigation and production, but also if an investigation by the authorities and the court, which is to be carried out ex officio and regularly has more investigative approaches at its disposal, has led to the result that the fulfilment of the constituent element of the offence, from the existence of which the person concerned wishes to derive favourable legal consequences for him, cannot be proven.<br />
<br />
112 <br />
It follows from the foregoing that in the present case the burden of proof is on the plaintiff inter alia to prove that he is seeking a "correction" within the meaning of Art. 16 sentence 1 DSGVO, i.e. the registration of a date of birth which objectively corresponds to reality. Since, as has been shown, this is not demonstrably true even after the defendants and the courts have fulfilled their duty to investigate the facts, the action with the main claim must be rejected.<br />
II.<br />
<br />
113 <br />
The action is also unfounded in the alternative claim.<br />
<br />
114 <br />
The plaintiff has no claim against the defendant that the current entry in the register of residents regarding his year of birth ("1958") be replaced by the sequence of numbers "0000". Neither Union law (1.) nor national law (2.) provides a basis for such a claim.<br />
<br />
115 <br />
1) The plaintiff is not able to base the asserted claim on Article 17 of the DSGVO, which may be applicable under Union law.<br />
<br />
116 <br />
According to its official title, this provision regulates the "right to be forgotten" and is also applicable within the scope of application of the Federal Registration Act, subject to the special provisions of § 14.3 of the Federal Ministry of Health (BMG), as amended (cf. the explanatory memorandum to the draft law on the 2nd DSAnpUG-EU, Bundestag-Drs. 19/4674, pp. 224 f.). Pursuant to Article 17.1 letter d of the DPA, the person concerned has the right to demand that the person responsible for the data be immediately deleted if the personal data has been "unlawfully processed". The plaintiff cannot derive any claim for deletion from this provision. This is already contradicted by the fact that, as has been shown, it cannot be shown that the defendant "unlawfully" processed the personal data on his birthday by using objectively incorrect data (cf. again Article 5 paragraph 1 letters a and d FADP), and this "non liquet" is at his expense according to the rules on the burden of proof (cf. above under I.5.b). The other elements of the offence set out in Article 17.1 DSGVO are not relevant in the present case either.<br />
<br />
117 <br />
(2) Nor does national law confer on the applicant any right to have the current entry in the register of residents concerning his year of birth ('1958') replaced by the numerical sequence '0000'.<br />
<br />
118 <br />
a) Pursuant to Section 14 (1) sentence 1 of the Federal Ministry of Health, the notification authority must delete stored data if they are no longer required for the fulfilment of its tasks. This requirement is not fulfilled here. The tasks of the registration authorities include in particular registering the persons (residents) residing in their area of responsibility in order to be able to determine and prove their identity and their dwellings, and to provide information from the register of residents in accordance with the statutory requirements (cf. Section 2 (1) and (3) BMG). In order to fulfil these tasks, it is still necessary to have the previous entry stored for the plaintiff's date of birth. This is already necessary because the plaintiff has been in legal relations in the Federal Republic of Germany for decades with the date of birth which he himself has stated since the 1970s and has issued to state authorities and, as has been shown, the correctness of the other date of birth which he has claimed in the Federal Republic of Germany since 2015 is not established.<br />
<br />
119 <br />
b) Pursuant to Section 14 (1) sentence 2 of the Federal Ministry of Health, the reporting authority must also delete stored data if the storage of the data was already inadmissible. This requirement is not met here either. The storage of birth data was already in the 1970s - and has been continuously since then - an essential part of the task of the registration authorities to register residents (cf. §§ 1, 4, 7 f. of the Baden-Württemberg Law on Registration - Registration Law - of 07.03.1960, GBl. p. 67, in the version of Art. 9 of the Law on the Adjustment of Criminal and Fines Regulations of the State of Baden-Württemberg of 06.04.1970, GBl. 111 <113> in connection with § 3.1 letter a of the Registration Ordinance of 21 March 1960, Federal Law Gazette p. 109, and No. 3 column 4 of Annex 1 [registration form] to this provision as well as No. 34.1 letter a of the VwV of the Ministry of the Interior on the Registration Act of 8 April 1960, GABl. p. 271, printed by Pflüger, Das Meldegesetz für Baden-Württemberg; see today the corresponding § 3.1 No. 6 BMG as amended). At the time the plaintiff moved in, the defendant was also not prevented from adopting the date ("1 January 1958") indicated by the plaintiff in the 1970s and registered in his official Turkish documents. For at that time there were not yet any concrete indications of the incorrectness of this date (see no. 35 sentence 1 of the last-mentioned administrative regulation ["The register of residents must be updated on the basis of the reports to be submitted under the Reporting Act ... to be kept"]; see today § 6.3 of the Federal Ministry of Health, new version). In particular, the plaintiff did not raise any doubts in this regard at the time.<br />
<br />
120 <br />
c) The Plaintiff is also not entitled to a claim that the current entry in the register of residents for his year of birth ("1958") be replaced by the sequence of numbers "0000" on the basis of Sec. 3 of the Federal Law on Civil Matters in conjunction with Sec. No. 3.0.2 of the General Administrative Regulation for the Implementation of the Federal Registration Act (BMGVwV) of 28 October 2015 (BAnz AT 30.10.2015 B2).<br />
<br />
121 <br />
§ Section 3 BMG regulates the storage of data and determines, among other things, which data and notices the reporting authorities must store in order to fulfil their duties under Section 2 (1) and (3) BMG. According to Section 3 (1) no. 6 BMG, these data include, as shown, the date of birth. The Federal Government has laid down more detailed provisions for the implementation of this provision in the aforementioned administrative regulation. According to No. 3.0.2 BMGVwV, the "Data set for the reporting system 'Uniform Federal/Länder Section (DSMeld)'" determines The form and content of data and instructions for storage in the population register and for electronic transmissions, and "further details" can be found in DSMeld. According to this, missing or incomplete birth data are marked by the entry of zeros in the daily, monthly and/or annual details (see "Datensatz für das Meldewesen", KoSIT [Ed.], 19.10.2018, data sheet 0601 [date of birth], printed in: Ehmann/Brunner, Passport, identity card and registration law, 24th AL, File 3, under IV.4.)<br />
<br />
122 <br />
No decision is required as to whether these requirements, which are based on an administrative regulation and thus are to be assigned to the internal law of the administration, can be suitable at all for conveying claims to benefits to outside third parties, which would be possible at best in connection with the principle of equality (Article 3.1 of the Basic Law). For the present facts of the case already do not fall within the scope of application of those provisions. With regard to the plaintiff, the defendant is not faced with the question of how to deal with a "missing or incomplete" date of birth. Instead, it is disputed between the parties involved whether the - existing and complete - details of the plaintiff's date of birth, which are already entered in the civil register, are incorrect and whether the different date of birth claimed by the plaintiff is correct. According to the above, the relevant legal provisions for answering these questions are solely Art. 16 DSGVO in conjunction with § 12 BMG in the new version and Art. 17 DSGVO in conjunction with § 14 BMG new version, but not § 3 BMG and the administrative provisions issued in connection therewith.<br />
B.<br />
<br />
123 <br />
The decision on costs follows from Paragraph 154(1) of the VwGO.<br />
C.<br />
<br />
124 <br />
The audit is to be approved in accordance with § 132 Para. 2 No. 1 VwGO. The case is of fundamental importance with regard to the question of the distribution of the burden of proof within the scope of application of Article 16 sentence 1 DSGVO in the field of German reporting law. The same applies to the question of whether there is a claim to the entry of the sequence of numbers "0000" in the case of a date of birth entered in the register of residents, the accuracy of which remains unclear after the possibilities of investigation have been exhausted.<br />
<br />
125 <br />
Decision of 10 March 2020<br />
<br />
126 <br />
The amount in dispute in the appeal proceedings is set at EUR 5,000.00 pursuant to § 63.2 sentence 1, § 39.1, § 47.1, § 52.2 GKG (see NdsOVG, decision of 25 April 2014 - 11 ME 64.14 - NdsVBl. 2014, 321; OVG MV, decision of 25 August 2003 - 1 L 160/03 - juris).<br />
<br />
127 <br />
The decision is unappealable.<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VG_Hamburg_-_17_K_3920/19&diff=10186VG Hamburg - 17 K 3920/192020-05-11T13:25:19Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VG Hamburg - 17 K 3920/19<br />
|-<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG Hamburg (Germany)|VG Hamburg (Germany)]]<br />
[[Category:VG Hamburg (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:Germany]]<br />
|-<br />
|Relevant Law:||[[Article 6 GDPR#1c|Article 6(1)(c) GDPR]]<br />
[[Category:Article 6(1)(c) GDPR]]<br />
<br />
[[Article 6 GDPR#1e|Article 6(1)(e) GDPR]]<br />
[[Category:Article 6(1)(e) GDPR]]<br />
|-<br />
|Decided:||16. 1. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||17 K 3920/19<br />
|-<br />
|European Case Law Identifier:||<small>n/a</small><br />
|-<br />
|Appeal from:||n/a<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[https://openjur.de/u/2195221.html OpenJur (in DE)]<br />
|}<br />
<br />
The Hamburg Administrative Court decided that the publication of the plaintiff's salary by his employer as a public institution is lawful according to Article 6 (1) (c), (e) GDPR and the applicable Hamburg transparency law. The Court argued that a high level of transparency with regard to the use of public funds represents a public concern of considerable importance and a mere aggregated publication does not create the same level of transparency.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff contests the publication of his remuneration in accordance with the Hamburg Transparency Act (§ 3 (1) No. 15 HmbTG). The plaintiff is employed by the University Medical Center in Hamburg, a corporation under public law. <br />
The defendant's financial authority informed the University Medical Center that its subsidiaries would largely fail to meet the requirements of the Hamburg Transparency Act on the disclosure of management remuneration. It is asked to influence the management and to ensure that the next year's remuneration report is published. The University Medical Center informed the plaintiff that the intention was to transmit the requested information on his remuneration and fringe benefits to the defendant.<br />
<br />
===Dispute===<br />
The Hamburg Administrative Court had to decide, if the publication of the remuneration of the plaintiff is lawful.<br />
<br />
Plaintiff: The plaintiff argued his legitimate interest in determining that his salary information should not be published. He argued that the Hamburg Transparency Act is not applicable and therefore, the publication of his remuneration violates his general right of personality. <br />
In addition, according to the German Federal Data Protection Law (§ 26 BDSG,) personal data of employees for the purposes of the employment relationship should only be processed if this is for the decision on the establishment of an employment relationship or after the establishment of the employment relationship for its implementation or termination or for the exercise or fulfillment resulting from a law or a Collective agreement, a company or service agreement (collective agreement) resulting rights and obligations of the representation of interests of employees. This requirement is missing here.<br />
<br />
Defendant: The defendant is of the opinion that the plaintiff's salary should be published. According to the Hamburg Transparency Act, which is applicable according to the defendant, essential company data of municipal holdings, including a description of the annual remuneration and fringe benefits for the management level, should be published. The interference with the plaintiff's personal rights brought about by the publication of his remuneration was therefore justified and proportional. Remuneration information does not concern tighter privacy, but the professional area and is therefore not highly sensitive data, especially since it does not allow any reliable conclusions to be drawn about the financial situation. Employment contract regulations would not prevent publication.<br />
<br />
===Holding===<br />
The court decided that the publication of the plaintiff's remuneration does not violate data protection regulations. The court stated that, contrary to the plaintiff's opinion, the inadmissibility of data processing does not arise from a law in the German federal data protection act (§ 26 BDSG). The respective law does not conclude on the admissibility of the processing of personal data of employees, so that in any case recourse to the general regulations of the GDPR would remain possible. In this respect, the legality of the data processing results from Art. 6 (1) (c), (e) GDPR and from the applicable Hamburg transparency law (§ 3 (1) No. 15 HmbTG).<br />
The court argued that the establishment of a high level of transparency with regard to the use of public funds, which is pursued by the regulation, represents a public concern of considerable importance. The provision of the Hamburg transparency law pursues a legitimate purpose insofar as it provides for the publication of the remuneration of the management level of urban participations. This consists in creating transparency with regard to the type and scope of the use of public funds for the purpose of economic activity what gives the public the opportunity to assess the appropriateness of this use of funds. In this respect, the publication not only serves to satisfy general curiosity, but also contributes to the public opinion-forming process in a democratic society.<br />
<br />
The respective law is also suitable and necessary to achieve this purpose. In particular, a mere aggregated publication of the remuneration of a particular associated company does not create the same level of transparency with regard to the appropriateness of the use of funds in the respective individual case.<br />
<br />
After all, there can be no objection to the fact that the legislature, in the context of its prerogative of assessment, has given (reasonable) preference to the legitimate interest of transparency in the public when weighing up the opposing interests.<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre><br />
tenor<br />
<br />
The charges get dismissed.<br />
<br />
The applicant is ordered to pay the costs.<br />
<br />
The judgment is provisionally enforceable because of the cost. The plaintiff can avoid enforcement by providing security in the amount of the costs to be determined, unless the defendant provides security in the amount of the amount to be enforced prior to enforcement.<br />
Fact<br />
<br />
The plaintiff contests the publication of his remuneration in accordance with Section 3 (1) No. 15 of the Hamburg Transparency Act (HmbTG).<br />
<br />
The plaintiff is employed by the University Medical Center Hamburg-Eppendorf (UKE), a corporation under public law, whose sole sponsor is the defendant Free and Hanseatic City of Hamburg. The appointment was made - initially for a limited time until ... - with an employment contract from ... as commercial manager for ... at the UKE. The employment contract was subsequently extended on an ongoing basis, with the plaintiff serving in various departments and companies of the UKE. With an amendment agreement dated ... 2015, the UKE and the plaintiff agreed that the plaintiff would take over the management of ... GmbH ... from April 2015, the sole shareholder of which was UKE. In an amendment agreement dated ... 2015, the UKE and the plaintiff agreed that the plaintiff would dedicate his full workforce to the management of ... GmbH from ... 2015.<br />
<br />
In a letter addressed to the plaintiff dated "Letter of Intent" dated ... 2017, UKE announced that the position of a "..." should be created, which would be a staff position assigned to the UKE board act. It was assured that this position would be filled by the plaintiff, who, in addition to his work as sole managing director of ... GmbH, was to take this position. For further details, reference is made to the letter dated ... 2017.<br />
<br />
For his work, the plaintiff receives a fixed remuneration from the UKE plus a variable remuneration and various fringe benefits (including a middle class company car).<br />
<br />
In a letter dated November 19, 2018, the defendant's financial authority informed UKE that its subsidiaries would largely fail to meet the requirements of the Hamburg Transparency Act on the disclosure of management remuneration. It is asked to influence the management and to ensure that the next year's remuneration report is published. There are no indications that the management concerned still took stock protection aspects into account.<br />
<br />
In a letter dated August 9, 2019, the Authority for Science, Research and Equal Opportunities asked the UKE to ensure that it provided the data necessary to fulfill the obligation under Section 3 (1) No. 15 HmbTG the plaintiff is available by August 15, 2019. For details, please refer to the letter of August 9, 2019.<br />
<br />
The plaintiff became aware of this letter on August 12, 2019. On August 13, 2019, UKE informed the plaintiff that the intention was to transmit the requested information on his remuneration and fringe benefits to the defendant.<br />
On 16.08.2019 the plaintiff brought an (declaratory) action. He had a legitimate interest in determining that his salary information should not be published. Neither the UKE as a corporation under public law nor its subsidiaries are, according to the current legal situation, subject to the publication obligation under the Hamburg Transparency Act. The Hamburg Higher Administrative Court had already determined that, according to the current legal situation, the obligation to publish does not extend to institutions of indirect state administration. The publication of his remuneration violates his general right of personality. In addition, according to § 26 BDSG, personal data of employees for the purposes of the employment relationship should only be processed if this is for the decision on the establishment of an employment relationship or after the establishment of the employment relationship for its implementation or termination or for the exercise or fulfillment resulting from a law or a Collective agreement, a company or service agreement (collective agreement) resulting rights and obligations of the representation of interests of employees. This requirement is missing here. In addition, he, the plaintiff, does not receive his remuneration from ... GmbH, but solely from UKE. He was employed at the UKE as a simple employee and only acted on the basis of his employment contract relationship with the UKE as managing director of ... GmbH. Finally, it should be borne in mind that since 2017 he has received his remuneration not only for his work as managing director of ... GmbH, but also for his work as ... If his remuneration were published, it would misleadingly include remuneration components that had nothing to do with his management function as managing director of ... GmbH.<br />
<br />
The applicant claims that<br />
<br />
to determine that the defendant is not entitled to publish the annual remuneration including the ancillary services of the plaintiff for his work as managing director of ... GmbH in accordance with the Hamburg Transparency Act.<br />
<br />
The defendant claims that<br />
<br />
reject the complaint.<br />
<br />
The defendant is of the opinion that the plaintiff's salary should be published. Both the UKE and the ... GmbH are information-requiring bodies under the Hamburg Transparency Act. According to Section 3, Paragraph 1, No. 15 of the HmbTG, the essential company data of municipal holdings, including a description of the annual remuneration and fringe benefits for the management level, should be published. The interference with the plaintiff's personal rights brought about by the publication of his remuneration was justified. In particular, the intervention is proportional. Remuneration information does not concern tighter privacy, but the professional area and is therefore not highly sensitive data, especially since it does not allow any reliable conclusions to be drawn about the financial situation. Employment contract regulations would not prevent publication.<br />
reasons<br />
<br />
I.<br />
<br />
The action is admissible (1.), but unfounded (2.).<br />
<br />
1. The application is admissible.<br />
<br />
a) The action is admissible as a declaratory judgment in accordance with Section 43 (1) VwGO. The parties argue about the application of a legal norm to a specific, manageable situation that specifically affects the plaintiff (see BVerwG, judgment of 25.10.2017, 6 C 46/16, juris, para. 12), namely whether § 3 Paragraph 1 No. 15 HmbTG entitles the defendant to (and obliges) to publish the remuneration that the plaintiff receives for his work as managing director of ... GmbH.<br />
<br />
b) The plaintiff has a legitimate interest in the coveted early determination. The defendant will promptly publish the plaintiff's remuneration; an unauthorized or legal publication would constitute an illegal interference in the plaintiff's right to informational self-determination (see BVerfG, decision of 25.02.2008, 1 BvR 3255/07, juris, margin no. 17 ff.).<br />
<br />
c) The principle of subsidiarity does not conflict with the admissibility of the declaratory judgment. The provision of Section 43 (2) VwGO, according to which the determination of the existence or non-existence of a legal relationship cannot be sought, insofar as the plaintiff can or could have pursued his rights through an action for performance or performance, is to be interpreted and applied in a restrictive manner . If the question in dispute between the parties involved can be clarified properly and in full consideration of their interest in legal protection by a declaratory judgment, it is forbidden to refer the plaintiff to an action for performance or performance, in the context of which the legal relationship, in the independent determination of which he has a legitimate interest, on the one hand, would only be a preliminary question, on the other hand, the other elements of the claim to be asserted - as here - would only be of secondary importance (see BVerwG, judgment of 29 April 1997, 1 C 2/95, juris, para. 25).<br />
<br />
2. However, the application is unfounded.<br />
<br />
The defendant Free and Hanseatic City of Hamburg is entitled to publish the remuneration including fringe benefits that the plaintiff receives for his work as managing director of ... GmbH. In this respect, Section 3 (1) No. 15 HmbTG establishes the defendant's duty to publish (see a). The provision of Section 3 (1) No. 15 HmbTG is compatible with the Basic Law (see b)). An inadmissibility of the publication does not follow from data protection regulations (see c)).<br />
<br />
a) Section 3 (1) No. 15 HmbTG obliges - and therefore authorizes - the defendant to publish the plaintiff's remuneration for his work as managing director of ... GmbH. According to this regulation, the essential corporate data of municipal holdings, including a presentation of the annual remuneration and fringe benefits for the management level, are subject to the obligation to publish under the HmbTG.<br />
<br />
aa) Addressee of the publication obligation according to § 3 Paragraph 1 No. 15 HmbTG is (alone) the defendant Free and Hanseatic City of Hamburg. This is supported by both the concept of “urban participations”, which takes the defendant's perspective, and the fact that the legislator created the annual law before the HmbTG came into force when the § 3 Paragraph 1 No. 15 of the HmbTG was created The defendant's participation report (see Bü-Drs. 20/4466, p. 15), in which the defendant presents the essential company data of its participations, including participations that - like the UKE as a corporation under public law - according to are not subject to the obligation to publish until 31.12.2021 (see Article 5 of the Act amending the Hamburg Transparency Act and the Hamburg Environmental Information Act as well as the decree implementing the Consumer Information Act of 19.12.2019, HmbGVBl. 2020, 19).<br />
<br />
bb) The claimant's remuneration for his work as managing director of ... GmbH, including ancillary services, falls within the scope of the publication obligation in accordance with section 3 (1) no. 15 HmbTG.<br />
<br />
(a) The ... GmbH is an urban (corporate) participation i.S.d. Regulation. It is a legal person under private law, the sole shareholder of which is the University Medical Center Hamburg-Eppendorf (UKE), which in turn is a corporation under public law (Section 1 (1) UKEG), which is under the supervision of the defendant ( Section 3 (5) UKEG). It operates economically on the market. Already in the annual participation reports of the defendant Free and Hanseatic City of Hamburg published before the HmbTG was issued, it was reported as a (corporate) participation of the defendant (see e.g. participation report for the year 2010, Bü-Drs. 20/2343, p. .. .).<br />
<br />
(b) The statutory feature of the "Presentation of annual remuneration and fringe benefits for management level" also includes the claimant's remuneration for his work as managing director of ... GmbH.<br />
<br />
(aa) The plaintiff belongs to the management level of ... GmbH. In this respect, it can be left open whether the indefinite and therefore in need of interpretation term management level only the managing bodies of the respective participation (so Maatsch / Schnabel, HmbTG, 1st edition 2015, § 3 marginal 132 mwN) or beyond that also possible other owners of higher management functions recorded without such an organ position. As the sole managing director of ... GmbH, the plaintiff is in any case associated with its management level.<br />
The applicability of Section 3 (1) No. 15 HmbTG does not prevent the plaintiff from receiving his remuneration from ... GmbH, but from UKE, since he only works at UKE and only on the basis of UKE's labor law instructions as managing director of ... GmbH is active. In this respect, the wording "for the management level" already suggests that it is not a question of who, but for which activity the remuneration is paid. This is also required by the purpose of Section 3 (1) No. 15 HmbTG, which is to improve the control of the use of public funds in the area of the defendant's economic activity (see Maatsch / Schnabel, loc. Cit., Section 3 marginal note 126). . In the present case, the plaintiff receives his remuneration, at least insofar as its publication is the subject of the lawsuit, precisely for his work as managing director of ... GmbH.<br />
<br />
(bb) In the present case, the "presentation of the annual remuneration and fringe benefits for the management level" also includes the concrete, individualized figure of the remuneration of the plaintiff for his work as managing director of ... GmbH, including any fringe benefits granted.<br />
<br />
With a view to the wording of the law, the summarizing term “management level” could indicate that the regulation only provides an aggregated representation of the remuneration of all members of the management level. The term “representation” as such could also speak for this, which is not used again in the description of the other subjects of the publication obligation pursuant to Section 3 (1) No. 15 HmbTG; rather, this term in Section 9 (1) HmbTG denotes the summarized, prepared presentation of such information, the direct disclosure of which is prohibited.<br />
<br />
However, these conclusions are not mandatory. For example, the legislature may simply have chosen the non-technical term management level as a generic term for the different types of management bodies depending on the legal form of participation, without wanting to express a decision against an individualized publication. Furthermore, the justification of the law, in which, without any reference to the term of the presentation, simply speaks of a “publication of remuneration and fringe benefits at management levels” (Bü-Drs. 20/4466, p. 15), indicates that this Term in the context of § 3 Paragraph 1 No. 15 HmbTG should not have such a meaning.<br />
<br />
Taking legal and systematic aspects into account, it can rather be assumed that the legislator always had an individualized publication in mind when creating Section 3 Paragraph 1 No. 15 HmbTG. This is supported by the fact that at the time of the adoption of the HmbTG, the Hamburg Corporate Governance Code applicable to companies with a majority stake in the defendant in para. 4.2.6 already explicitly provided for the disclosure of the remuneration of the individual members of the management. It is not clear why the publication obligation pursuant to Section 3 Paragraph 1 No. 15 HmbTG should have deliberately lagged behind this already established standard. Accordingly, the defendant's authorities have made several statements to the Hamburg citizens that they understand Section 3 Paragraph 1 No. 15 HmbTG as an individualized obligation to publish (cf. Bü-Drs. 20/7029, p. 1; Bü-Drs. 20/11657, p. 2), and published a corresponding annual remuneration report from 2013 onwards (see for 2013: Bü-Drs. 20/13676). It can be assumed that this interpretation also corresponded to the will of the legislature. Otherwise it would be difficult to explain why § 3 Paragraph 1 No. 15 HmbTG not only remained unchanged in the context of the amendment of the HmbTG in 2019, but the scope of the regulation on the occasion of this amendment, as far as can be seen, was not discussed at all.<br />
The regulations of the HmbTG for the protection of personal data also speak in favor of the acceptance of an individualized obligation to publish. Section 4 (1) sentence 1 of the HmbTG stipulates that personal data must be made unrecognizable before publication. Since section 4 (1) sentence 2 of the HmbTG does not exclude publication in accordance with section 3 (1) no.15 of the HmbTG, the conclusion could be drawn that section 3 (1) no. 15 of the HmbTG does not provide for individualized publication because it does so would be inadmissible anyway. In the board's view, however, section 4 (1) sentence 1 HmbTG should not be applied to the publication pursuant to section 3 (1) no.15 HmbTG because the provision is superseded by section 4 (4) HmbTG as a more specific regulation, insofar as personal data etc. are concerned about employees of bodies obliged to provide information. In this respect, section 4 (4) sentence 2 HmbTG provides that such data should not be excluded from publication in accordance with section 3 (1) no. 15 HmbTG. This regulation allows the conclusion that Section 3 Paragraph 1 No. 15 HmbTG provides for an individualized publication of the remuneration (Maatsch / Schnabel, loc. Cit., Section 3 marginal number 134): If only an aggregated publication would be desired, Section 4 would have Paragraph 4, sentence 2 of the HmbTG, because personal data is not affected at all - there is no scope at all - unless an individualized publication would be permitted in exceptional cases if the management level consisted of only one person, i.e. aggregated publication was impossible (see Maatsch / Schnabel, ibid). However, the legislature could not have wanted this given the objectified approach (see BVerfG, judgment of 17.01.2017, 2 BvB 1/13, juris, marginal 555), since there is no reason for such unequal treatment.<br />
<br />
(c) An application of Section 3 (1) No. 15 HmbTG to the plaintiff's specific remuneration for his work as managing director of ... GmbH does not prevent the plaintiff's remuneration to be published from misleadingly including such remuneration components who have nothing to do with the activity as managing director of ... GmbH. It may be a question of whether the plaintiff actually performs another job as ... besides his job as managing director of ... GmbH, as he put forward. Because the defendant's obligation and authorization to publish the plaintiff's remuneration is limited to that part of the plaintiff's remuneration that is attributable to his work as managing director of ... GmbH. It is not apparent that the defendant should, after consultation with the UKE and inspection of the employment contract documents relating to the plaintiff, not be able to determine this part of the plaintiff's remuneration or to influence the UKE, the remuneration for the The applicant's activities as managing director of ... GmbH and the remuneration for any further activities of the applicant must be clearly separated in the employment contract.<br />
<br />
(d) Finally, the plaintiff is also not to be excluded from the scope of Section 3 (1) No. 15 HmbTG from the point of view of the protection of legitimate expectations. In this respect, it can be left open whether those members of the management levels of municipal holdings who already held their respective function before the HmbTG came into force on October 6, 2012 are not subject to the publication obligation in accordance with 3 (1) No. 15 HmbTG. The plaintiff has been working for the UKE since ...; he was appointed managing director of ... GmbH - only in this capacity is he affected by the publication at issue here - but was only appointed in 2015.<br />
<br />
b) Furthermore, the court has no doubts about the compatibility of § 3 Paragraph 1 No. 15 HmbTG with the Basic Law. The regulation is constitutionally as well as formally.<br />
<br />
aa) Section 3 (1) no.15 HmbTG is formally constitutional. The regulation is covered by the legislative competence of the Free and Hanseatic City of Hamburg (see above) and is also not within the meaning of Article 31 GG incompatible with federal law (see bb.).<br />
<br />
(1) The subject matter of Section 3 Paragraph 1 No. 15 of the HmbTG falls under the legislative competence of the Free and Hanseatic City of Hamburg as a state according to the general allocation rule of Article 70 Paragraph 1 GG. In particular, it does not concern the “law of the economy” as the subject of competing legislation in accordance with Section 74 (1) No. 11 GG.<br />
In the Chamber's view, corresponding concerns regarding the provision of Section 3 (1) No. 15 HmbTG are unfounded. The regulation contained therein is not the law of the economy i.S.d. 74 Paragraph 1 No. 11 of the Basic Law. According to the case law of the Federal Constitutional Court, this includes all standards that regulate economic life and economic activity as such (BVerfG, decision of July 11, 2006, 1 BvL 4/00, juris, para. 57). However, the obligation to publish according to Section 3 Paragraph 1 No. 15 HmbTG lacks such a specifically economic regulating tendency.<br />
<br />
First of all, the regulation is not aimed at the companies in which the Free and Hanseatic City of Hamburg is involved; rather, the obligation to publish applies to the Free and Hanseatic City of Hamburg itself (see above). Accordingly, the regulation does not provide for publication in the annual financial statements of the respective company; rather, the publication for all the companies concerned is collected in an annual remuneration report (see, for example, Bü-Drs. 20/13676). This alone makes a decisive difference to the regulations of other state legislatures, which have already raised the question of a direct collision with the regulations of the HGB.<br />
<br />
In fact, the obligation to publish does not serve to regulate the economic activity of the companies concerned. Its sole purpose is to disclose in what manner and to what extent the state is economically involved with public funds (Maatsch / Schnabel, loc. Cit., § 3 marginal no. 136). Such requirements regarding the transparency of state action are to be attributed to the state organization law of the Free and Hanseatic City of Hamburg as a state. In contrast, any effects of the obligation to publish on the economic activity of the respective companies are of a purely indirect nature and do not give the regulation any specific economic regulatory character (cf. ibid.).<br />
<br />
(2) Finally, the provision of section 3 (1) no.15 HmbTG is also not within the meaning of Article 31 GG incompatible with federal law. In particular, there is no collision i.S.d. Art. 31 GG compared to §§ 285 sentence 1 No. 9 lit. a, 286 (4) HGB. Such a collision presupposes that the relevant standards of federal and state law relate to an identical subject of regulation and contain mutually incompatible standard commands (cf. Hellermann, in: Epping / Hillgruber, GG, 41st Ed. 2019, Art. 31 marg. 13 mwN ). These requirements are not met.<br />
<br />
According to § 285 S. 1 No. 9 lit. a HGB have medium-sized and large corporations in the notes to the annual financial statements to provide the total remuneration granted to the members of their management body for their work in the financial year. Section 286 (4) HGB exempts companies that are not listed stock corporations from this obligation if the remuneration of a particular member of the management body can be determined on the basis of this information. Listed stock corporations have additionally according to § 285 S. 1 No. 9 lit. a p. 5-7 HGB separately state the remuneration of each individual member of the Board of Management by name, which, according to Section 286 (5) HGB, can only be waived if the Annual General Meeting has passed a corresponding resolution.<br />
<br />
Section 3 (1) no.15 HmbTG, as well as sections 285 sentence 1 no.9 lit. a, 286 (4) HGB disclose the remuneration of the management bodies (among others) of corporations and clearly differs from the federal law regulations with regard to the scope of this disclosure; However, the two regulations differ on the one hand with regard to their addressee, but above all in their purpose in such a considerable way that no identical subject of regulation i.S.d. Art. 31 GG exists, which is why the deviating standard commands are compatible with each other.<br />
<br />
Sections 285 sentence 1 no.9 lit. a, 286 (4) HGB are part of the legal requirements for the annual financial statements of a corporation. This pursues several purposes, in particular the control of the management by the shareholders and the information of current or potential creditors and capital market participants in advance of their decisions about granting or maintaining credit or the purchase and sale of equity and debt (Reiner, in: MünchKomm-HGB, 3rd edition 2013, § 264 Rn. 27; see also Maatsch / Schnabel, loc. cit., § 3 Rn. 136). The obligation to disclose the remuneration of the management bodies also serves the specific economic interests of the market participants or the shareholders of the respective company, in particular the shareholders of a stock corporation (see the justification of the law, BT-Drs. 15/5577, p. 5)<br />
<br />
Section 3 (1) no.15 HmbTG, on the other hand, is aimed at the state as a dispatcher via public funds and subjects them to special transparency obligations that exist in the general public interest regardless of the specific economic activity of the respective associated companies (cf. already above).<br />
<br />
bb) Section 3 (1) No. 15 HmbTG is also constitutionally substantive. The provision does indeed encroach on the right to informational self-determination from Art. 2 Para. 1 in conjunction with 1 sec. 1 GG; however, this interference is constitutionally justified.<br />
<br />
(1) The publication of the remuneration of the management level of municipal holdings in the form provided for by section 3 (1) no. 15 of the HmbTG, which, in the board's opinion, provides for individualized publication (see above), falls within the scope of protection provided for by article 2, section 1 in conjunction Art. 1 para. 1 GG guarantees the fundamental right of the data subjects to informational self-determination. This includes the authority of the individual to decide for himself whether, when and within what limits a personal life fact is disclosed; an intervention is in particular the public disclosure of personal data (see BVerfG, decision of 25.02.2008, 1 BvR 3255/07, juris, para. 18). This is given when the amount of remuneration that the data subject receives for their work is published.<br />
<br />
(2) However, the interference is constitutionally justified. The fundamental right to informational self-determination is not guaranteed without restrictions. Rather, the individual has to accept such restrictions that are justified by overriding general interests and are based on a constitutional legal basis (BVerfG, loc. Cit., Para. 21). These requirements are met in relation to Section 3 (1) No. 15 HmbTG. In particular, the regulation maintains the principle of proportionality.<br />
<br />
(a) The provision of Section 3 Paragraph 1 No. 15 HmbTG pursues a legitimate purpose insofar as it provides for the publication of the remuneration of the management level of urban participations. This consists in creating transparency with regard to the type and scope of the use of public funds for the purpose of economic activity (Maatsch / Schnabel, op. Cit., § 3 marginal no. 136 f.). This is intended to give the public, in particular voters, taxpayers and the users of the services of urban companies, the opportunity to assess the appropriateness of this use of funds (cf. Bü-Drs. 20/7236, p. 1). In this respect, the publication not only serves to satisfy general curiosity, but also contributes to the public opinion-forming process in a democratic society (see also BVerfG, cited above, para. 24 in relation to Section 35 (6) sentence 2 SGB IV).<br />
<br />
(b) The regulation is also suitable and necessary to achieve this purpose. In particular, a mere aggregated publication of the remuneration of a particular associated company does not create the same level of transparency with regard to the appropriateness of the use of funds in the respective individual case.<br />
<br />
(c) The regulation is also appropriate, i.e. proportionate in the narrower sense. The severity of the procedure is not disproportionate to the weight of the intended purpose.<br />
<br />
The individualized publication of their remuneration initially means a not inconsiderable intervention for the persons affected by Section 3 Paragraph 1 No. 15 HmbTG. The relevant information enables, albeit to a limited extent, conclusions to be drawn about the private economic situation of those affected. There is also the risk that the remuneration will be the subject of objective, public discussions characterized by envy and denial (see BVerfG, loc. Cit., Para. 32). On the other hand, it must be taken into account already within the scope of the severity of the intervention that the information collected by Section 3 Paragraph 1 No. 15 HmbTG as such does not relate to the closer privacy of the data subject, but to their professional area. Companies with government participation are also under special public scrutiny anyway. In view of the fact that the public sector either finances the activities of these companies directly or in any case bears their risk, the members of the management levels can in principle also be expected to have a controversial public discussion about the appropriateness of their remuneration (see Pommer, NWVBl. 2010, 459, 461 f.). Insofar as such a discussion should leave the level of objectivity in individual cases, the person concerned is at liberty to counter any violations of his or her right to privacy with the appropriate criminal and civil law legal protection options (see BVerfG, loc. Cit., Para. 41).<br />
<br />
In addition, the establishment of a high level of transparency with regard to the use of public funds, which is pursued by the regulation, represents a public concern of considerable importance. In addition to satisfying the public's justified interest in information as such, the individualized publication of the remuneration can provide concrete conclusions about financial management and enable any savings potential of urban participations. Remuneration can not only be viewed in isolation, but also in terms of its development and in connection with other information that is also accessible to the public (see BVerfG, loc. Cit., Para. 37).<br />
<br />
After all, there can be no objection to the fact that the legislature, in the context of its prerogative of assessment, has given preference to the legitimate interest of transparency in the public when weighing up these opposing interests.<br />
<br />
c) Finally, the publication of the plaintiff's remuneration does not violate data protection regulations. The associated processing of the plaintiff's personal data by the defendant initially corresponds to section 4 of the HmbDSG, since it is carried out to fulfill a task within its area of responsibility, namely the obligation under section 3 (1) no. 15 of the HmbTG.<br />
<br />
Contrary to the plaintiff's opinion, the inadmissibility of data processing does not arise from section 26 (1) sentence 1 BDSG. The transmission of the remuneration data for the purpose of publication should not fall into any of the case groups mentioned in section 26 (1) sentence 1 BDSG. However, § 26 BDSG does not conclude on the admissibility of the processing of personal data of employees, so that in any case recourse to the general regulations of the GDPR would remain possible (see Paal / Pauly, DS-GVO / BDSG, 2nd edition 2018, § 26 BDSG margin note 10 f.). In this respect, the legality of the data processing according to Art. 6 Para. 1 lit. c and e GDPR also from the defendant's obligation standardized in § 3 Paragraph 1 No. 15 HmbTG.<br />
<br />
II.<br />
<br />
The decision on costs is based on Section 154 (1) VwGO. The decision on the provisional enforceability results from § 167 Paragraph 1 Clause 1 and Paragraph 2 VwGO in conjunction. §§ 708 No. 11, 711 ZPO. <br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VG_Berlin_-_VG_3L_1028.19&diff=10185VG Berlin - VG 3L 1028.192020-05-11T13:24:28Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" | VG Berlin - 3L 1028.19<br />
|-<br />
<br />
| colspan="2" style="padding: 20px;" | [[File:CourtsDE.png|center|200px]]<br />
|-<br />
|Court:||[[:Category:VG Berlin (Germany)|VG Berlin (Germany)]]<br />
[[Category:VG Berlin (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:Germany]]<br />
|-<br />
|Relevant Law:||[[Article 17 GDPR#1a|Article 17(1)(a) GDPR]]<br />
[[Category:Article 17(1)(a) GDPR]]<br />
<br />
[[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]<br />
[[Category:Article 17(1)(d) GDPR]]<br />
|-<br />
|Decided:||28. 2. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||anonymous<br />
|-<br />
|National Case Number:||3L 1028.19<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:DE:VGBE:2020:0228.3L1028.19.00</small><br />
|-<br />
|Appeal from:||n/a<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://www.gerichtsentscheidungen.berlin-brandenburg.de/jportal/portal/t/eyj/bs/10/page/sammlung.psml;jsessionid=38823657AE1933C69AE66095D7EA6094.jp27?doc.hl=1&doc.id=JURE200003960&documentnumber=1&numberofresults=742&doctyp=juris-r&showdoccase=1&doc.part=L&paramfromHL=true#focuspoint Berlin-Brandenburg Court Decisions (in DE)]<br />
|}<br />
<br />
The Berlin Administrative Court denied the request of a student to delete his old school record after changing school. The school regulation in Berlin justifies the storage of the school record. The court did not see a loss of purpose according to Article 17(1)(a) GDPR. <br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff visited a school in Berlin where a record with notes from teachers about his behavior was created. The school record contains his insulting statements to classmates and teachers and notes because of disrupted teaching. The student changes the school recently.<br />
<br />
===Dispute===<br />
Were the requirements of Article 17 GDPR fulfilled and would the defendant require to delete the school record?<br />
<br />
===Holding===<br />
Article 17 (1) (a) GDPR grants a right to delete personal data, if the purpose for which the personal data was collected no longer exists and further storage is no longer necessary. The court did not see such a loss of purpose in this case. The VG held the applicable school regulation against the student and his parents. It stipulates that a change of school does not justify a loss of purpose. According to the school regulation the processing of personal data relating to pupils and legal guardians is necessary for the school to perform its tasks. This applies in particular to students' breaches of duty in order to be able to take the appropriate pedagogical measures and compare them with their effects in the past. <br />
The concerned school record shall be kept during the mandatory school period according to the school regulation. Since the student is still obliged to go to school, it can be assumed that the documents collected will continue to serve their purpose.<br />
<br />
Furthermore, the applicants have not made it credible that the personal data within the meaning of Article 17 (1) (d) GDPR were processed illegally.<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
tenor <br />
The applications for interim relief are rejected. <br />
The applicants are ordered to pay the costs. <br />
The value of the subject of the proceedings is set at EUR 2,500. <br />
reasons <br />
I. <br />
1 <br />
Applicants to 1) and 3) are parents of thirteen-year-old E ..., the applicant to 2). They desire the "cleanup" of his student file. <br />
2nd <br />
The applicant for 2) attended the S ... Gymnasium in Berlin -... from the 2018/2019 school year. After issuing a written reference and ordering the provisional exclusion from teaching after an incident of violence, the applicant to 2) no longer participated in the class there from November 2018 and did not pass the probationary year. From the school year 2019/2020, he attended the eighth grade of the W ... in Berlin-S ... (hereinafter: school). As a result, as shown in the student file, there were numerous discussions and an extensive correspondence between the applicants and the school and with other bodies, such as the Senate Department for Education, Youth and Family (hereinafter: School Supervision), as well as convening a school aid conference and the decree an oral blame. In the student file there are also notes from teachers about the behavior of applicant 2), among other things because of insulting statements to classmates and teachers and because of disruption to teaching. <br />
3rd <br />
On December 4, 2019, applicants 1) and 3) applied to the school to “remove all discriminatory entries about us parents and our son” from the student file. <br />
4th <br />
On December 23, 2019, the applicants requested an injunction. The pupil questionnaire part III contains evaluative and discriminatory statements about the family. The file was obviously created retrospectively for submission to the court. It was not properly managed, especially not in chronological order. Pages were missing, existed multiple times or were wrongly labeled as "double" or partially unpaginated in between. The origin and authorship of various documents, including handwritten records on the behavior of applicant 2), are partially unclear. The minutes of the class conference of October 10, 2018 and the school aid conference of December 12, 2019 were not dated or signed and therefore "invalid". At least one page is missing from each of the two opposition notices dated September 10, 2019. Such a formally incorrect student file could not fulfill the task assigned to it; rather, a tendentious picture emerges of a difficult student and difficult parents. Since the file was "hopelessly spoiled", a new file had to be created in which only the absolutely necessary documents were to be included, and repackaging had to be carried out so that the cleanup would not become apparent. Only the correspondence between the school and the parents, which is relevant for the school relationship, should be included. The correspondence with and between third parties is not recorded, since the corresponding data may only be saved and processed by the respective authorities. Various letters written by the parents had to be removed, since they showed the difficult relationship with the school, but they were not relevant to the school relationship of the applicant to 2). Since the relationship to the school was irreparably broken, a new school was currently being sought, whereby the student file represented a considerable obstacle and prevented an unencumbered restart. Applicant 2) is now attending a private school. However, there is a significant risk that the new school will not sign the school contract if it receives the file in its current version. <br />
5 <br />
Applicants request <br />
6 <br />
Order the defendant by way of an interim order to recreate for the applicant 2) the third part of the student file (student sheet and correspondence) relating to the S ... gymnasium and the W ... school and only the following, in the current student file with the page numbers 1, 3, 6, 9, 10, 11, 12, 14, 15, 45, 46, 63, 70, 72, 74 paginated pages without adding the pagination now on it in chronological order, furthermore also enclose the complete notice of objection dated September 10, 2019 against the written reference and against the suspension in chronological order and repaginate this file, <br />
7 <br />
alternatively, <br />
Order the defendant, by means of an interim order, to remove the following pages from the third part of the applicant's student file 2), which concerns the S ... Gymnasium and the W ... Schule, available to the court: 2, 4, 5, 7, 8, 13, 16-30, 32-44, 47-62, 64-69, 71, 73, 75-112, as well as the unpaginated pages between pages 83-84, 106-107, 108-109, 109 -110. <br />
8th <br />
The respondent requests that <br />
9 <br />
to reject the applications. <br />
10th <br />
He argues that the student file was not subsequently created for submission to the court or was manipulated in any other way. The student form only contains the intended content, especially since it consists to a large extent of correspondence written by the applicants themselves. The fact that the file may not have been kept with the utmost care, for example, the chronology was not always maintained, or documents were duplicated or only available in duplicate, did not mean that the relevant sheets had to be removed. The correspondence with the legal guardians and with the school supervision as well as medical statements are to be kept completely, since they concern the school development of the pupil. There is a willingness to remove the handwritten note in the file with a urinating rhino. Apparently, the admission to the private school was made even without knowledge of the content of the student file. In principle, student files would only be sent to the new school after admission. <br />
II. <br />
11 <br />
The applications are unsuccessful. <br />
12th <br />
Most of them are permissible. In particular, the jointly custodial applicants 1) and 3) can assert their parents' rights in their own name as well as the rights of their minor son, the applicant to 2), in accordance with sections 1626 (1), 1629 (1) sentence 1 and sentence 2 ms. 1 BGB as its legal representative. <br />
13 <br />
To the extent permitted, the applications are unfounded. <br />
14 <br />
Pursuant to section 123 (1) sentence 2 of the VwGO, the court can issue an interim order to regulate a provisional situation in relation to a legal relationship at issue if this regulation appears to avert essential disadvantages or for other reasons. Pursuant to Section 123 (3) VwGO in conjunction with Section 920 (2) of the ZPO, the actual requirements of the claim asserted (claim for an order) and the reasons for the urgent need for the judicial decision (reason for the order) must be demonstrated. If the applicants - as here - request the anticipation of the main decision, the issuing of an interim order presupposes that otherwise severe and unreasonable disadvantages threaten, which cannot be eliminated by the decision in the main, and that the applicants with their request in one The main proceedings will most likely be successful (cf. Oberverwaltungsgericht Berlin-Brandenburg, decision of August 11, 2006 - OVG 8 S 50.06 -, juris marginal no. 16 mwN). <br />
15 <br />
Based on these principles, the applicants have not made a claim to an order credible to an extent justifying the anticipation of the main matter. You are probably not entitled to a provisional "cleanup" and reorganization of the student file. <br />
16 <br />
The legal basis for the coveted right to rectification is provided solely by Article 17 (1) (a) or (d) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons when processing personal data, on the free movement of data and the repeal of Directive 95/46 / EC (General Data Protection Regulation - GDPR -) (OJ L 119 p. 1). <br />
17th <br />
The material scope of application of the GDPR according to Art. 2 Para. 1 GDPR is open. Thereafter, the regulation applies to the fully or partially automated processing of personal data as well as to the non-automated processing of personal data that are stored or are to be stored in a file system. The student file contains personal data within the meaning of Art. 4 No. 1 GDPR. These relate in particular to applicants to 2), but also to applicants to 1) and 3) and thus to identified natural persons. This data is not processed automatically, in any case it is collected, stored and adapted (see the definition in Art. 4 No. 2 GDPR). A file only in paper form represents a file system, namely a structured collection of personal data that is accessible according to certain criteria (Art. 4 No. 6 GDPR, see the personnel file of the State Labor Court of Saxony-Anhalt, judgment of November 23, 2018 - LAG 5 Sa 7/17 -, juris Rn. 63 f.). <br />
18th <br />
The keeping of the student file also falls within the scope of Union law within the meaning of Article 2 (1) (a) GDPR. This provision only excludes from the scope of the GDPR those activities that do not fall within the competence of the Union, regardless of whether they serve to implement Union law (see Zerdick, in: Ehmann / Selmayr, General Data Protection Regulation, 2nd edition 2018, Art. 2 marginal 5). However, the European Union has at least one support, coordination or supplementary function in the area of education in accordance with Article 6 (e) of the Treaty on the Functioning of the European Union (see also Articles 165 (4) and 166 (4)) TFEU in conjunction with Art. 288 (5) TFEU and the competence to issue legal acts in this area in the form of recommendations). <br />
19th <br />
According to Art. 17 Para. 1 lit. a) and d) GDPR, the data subject has the right to request the data controller to delete personal data concerning them immediately, and the data controller is obliged to delete personal data immediately, provided that One of the following reasons applies: The personal data are no longer necessary for the purposes for which they were collected or otherwise processed (letter a)) or the personal data were processed unlawfully (letter d)). <br />
20th <br />
It can be based on whether a right to erasure already arises from the exception rule in Art. 17 para. 3 b) old. 2 or 3 GDPR fails, according to which the claim does not exist if the data processing is carried out to perform a task that is in the public interest or in the exercise of official authority that has been transferred to the person responsible. <br />
21 <br />
In any case, the applicants have not made it credible that the material requirements of the basis for the claim are met. <br />
22 <br />
Applicants to 1) to 3) are data subjects within the meaning of Art. 4 No. 1 GDPR and the school is responsible within the meaning of Art. 4 No. 7 GDPR, namely an authority, institution or other body that alone or decides together with others about the purposes and means of processing personal data. <br />
23 <br />
However, a deletion is not apparent. <br />
24th <br />
The applicants did not initially show that the personal data were no longer necessary for the purposes for which they were collected or otherwise processed (Art. 17 (1) (a) GDPR). This presupposes that a certain data collection or processing was originally lawful, but the legality requirements due to the achievement of the purpose no longer existed (cf. Kamann / Braun, in: Ehmann / Selmayr, General Data Protection Regulation, 2nd edition 2018, Art. 17 para. 20 f.). <br />
25th <br />
When this is to be assumed in the case of the student file is regulated in detail on the basis of Section 66 of the School Act for the State of Berlin of January 26, 2004 (GVBl. P. 26) - SchulG -, last changed on April 9, 2019 (GVBl. P. 255) Ordinance on the Processing of Personal Data in Schools of October 13, 1994 (GVBl. P. 435) - SchuldatenV -, last changed on September 15, 2010 (GVBl. P. 446). The SchuldatenV shows that changing schools does not justify a loss of purpose. Thus, in accordance with section 10 (3) sentence 1 SchuldatenV, in the event of a change to another general education school (including recognized private schools, see section 10 (5) SchuldatenV), the (complete) student form will be sent to the new school. This is the only way that the student file can fulfill its purpose of making it possible to understand the development of the student's personality and behavior across his school career, as well as the cooperation with legal guardians over a longer period of time. The student form is also kept in accordance with § 11 Paragraph 1 Clause 1 No. 1 SchuldatenV in any case until the end of the compulsory schooling. Only after this period, which is based on the principle of data requirement, is the student file to be destroyed (see Krzyweck / Duveneck, The School Law in Berlin, introduction of the School Data Regulation, as of July 2016, paragraph 15). Before this, it can be assumed that the documents collected there will continue to serve their purpose of documenting the school development of the student and the cooperation between school and home. According to Section 11, Paragraph 2, Sentence 2 of the School Data Regulation, documents relating to the regulatory measures taken are generally no longer required after three school years have passed if no further regulatory measures have been taken afterwards. However, these requirements are not met here, since no three school years have passed since the written reference and the suspension by the S ... Gymnasium on October 11, 2018. <br />
26 <br />
Furthermore, the applicants have not made it credible that the personal data within the meaning of Article 17 (1) (d) GDPR was processed illegally. In any case, data processing is unlawful if there is neither the consent of the data subject nor any other legal basis for the processing (see Art. 6 Para. 1 GDPR). This legal basis can also come from national law. Insofar as the processing of personal data concerned is essential for the realization of the right to informational self-determination under Article 2 (1) in conjunction with Article 1 (1) GG, it must be based on a parliamentary law in German law (cf. Herbst, in : Kühling / Buchner, GDPR BDSG, 2nd edition 2018, Art. 5 GDPR marginal 8). Even if the data is “only” incorrect, the requirements of Article 17 (1) (d) GDPR can be met, since the processing of incorrect data is not regularly covered by the relevant legal basis (see Art. 17 GDPR marg . 29). It can be based on whether a broad understanding of the "illegality" is also indicated in such a way that a violation of other requirements and obligations arising from the GDPR or national law is sufficient (so Kamann / Braun, in: Ehmann / Selmayr, General Data Protection Regulation, 2nd ed. 2018 Art. 17 para. 27 with reference to the ECJ, judgment of May 13, 2014– C-131/12, Google Spain and Google -, juris para. 71– 72, 75, 92). <br />
27 <br />
Because the data processing carried out in the student file was lawful both with a narrow and with a broad understanding. It finds its legal basis in section 64 (1) sentence 1 of the School Act. According to this, schools may process personal data of pupils and their legal guardians, insofar as this is necessary to fulfill the school-related tasks assigned to them by law. The school-internal documentation of the school and personal development of the respective pupil as well as the cooperation between school and parental home serves to realize the school's educational mandate. The relevant educational goals include, for example, the development of active social action (see Section 3 (2) No. 1 School Act) and non-violent conflict resolution (see Section 3 (2) No. 6 School Act). The school and the legal guardians should work closely together (see Section 4 (1) of the School Act). As far as the storage of personal data of students about breaches of duty and their pedagogical and legal consequences is concerned, the storage is necessary for the fulfillment of tasks of the school, since the selection of a future educational measure always depends on the assessment of the behavior of the student in comparable past Situations is dependent (cf. VG Hannover, judgment of July 8, 2004 - 6 A 386/04 -, juris Rn. 22 ff.). The processing of personal data at school is detailed in the SchuldatenV, which was enacted on the basis of Section 66 of the School Act, the requirements of which are met here. <br />
28 <br />
Pursuant to Section 2 (1) SchuldatenV, the student form should contribute to a better understanding of the student's personality and at the same time serve as a basis for cooperation between the school and the home. The regulation of § 2 Para. 2 No. 14 SchuldatenV stipulates that the student form contains notes on contacts with the legal guardians and institutions that look after the student. Pursuant to Section 2 Paragraph 4 Clauses 1 and 2 SchuldatenV, the student file also collects "documents created about the student at school", in particular about transcripts of certificates, documents about the behavior of the student including any educational and regulatory measures as well as the correspondence relating to the student . These documents can be found in student form part III of applicant 2). <br />
29 <br />
The opinion of the headmistress currently attached to the beginning of the file remains with the respondent's assurance only in the file for the duration of the judicial proceedings. Certificates (sheets 1 and 2 of the student sheet part III) are part of the student sheet in accordance with section 2 (4) sentence 1 SchuldatenV. Even if the certificate from February 1, 2019 was corrected to the objection of the applicants to 1) and 3) (p. 42/43 of the student form part III) in such a way that the work and social behavior was not assessed, the certificate can be used as The purpose of the complete description of the facts remains in the file, especially since the actual assessment of work and social behavior has apparently been removed from the file and only the reference to the fact that an assessment has been made is still in the certificate. <br />
30th <br />
The correspondence between the legal guardians and the school can remain completely in the student file. Contrary to what the applicants believe, there is no limit to the regulation in Section 4 (4) sentence 2 of the SchuldatenV to the effect that only the correspondence relating to fundamental questions relating to the school relationship should be kept. Rather, it follows from the sense and purpose of the student's file, in addition to documenting the development of the student, to document the collaboration between the school and parents' home over school (see § 2 Paragraph 1 Sentence 1 School Data Regulation) that the complete correspondence is part of the student's file . This affects sheets 4, 7-11.15, 41-43, 47-50, 56-60, 62, 67-72, 74-75, 77-78, 85, 90, 97, 99, 101-102, 105 of the student form Part III. <br />
31 <br />
In addition, the regulation of Section 2 Paragraph 4 Sentence 2 SchülerV, according to which the “correspondence concerning the pupil” is collected in the pupil questionnaire, covers all correspondence about the pupil, including correspondence with third parties (see also Krzyweck / Duveneck, Das Schulrecht in Berlin, introduction of SchuldatenVO margin no.3). This also includes the correspondence conducted by applicants 1) and 3) regarding applicant 2) and the correspondence between the school and the school supervisory authority (pp. 16-19, 21, 23-24, 27, 29-32, 34-39, 41, 73, 76, 79-83, 98, 100 of the student form Part III), the district office S ... of Berlin <br />
- Jugendamt - (Bl. 20, 92/95, 103-104 of Schülerbogens III), the district office S ... of Berlin - Gesundheitsamt - (Bl. 22, 25, 84, 86, 112 of Schülerbogens Part III), the Police chiefs of Berlin (pp. 64-65 of the student sheet part III), the school psychological and inclusion pedagogical counseling and support center - SIBUZ - (sheets 91 and 94 of the student sheet part III) and the child and adolescent psychiatric service (sheets 93 and 96 of the student form part III) and between youth. or the Health Department and School Supervision (pages 26, 28, 33, 40 of the student form Part III). The letters each relate to the applicant's 2) school affairs and there are no reasons why they should not be included. <br />
32 <br />
Documents relating to the behavior of the student, including educational and regulatory measures and the correspondence associated with them, are also part of the student file in accordance with Section 2 (4) sentence 1 SchuldatenV. This includes the minutes of the class conference of October 10, 2018 and the subsequent written reference of October 11, 2018 and the orderly measures taken to suspend and implement a parallel class of November 23, 2018 and the correspondence associated with it and the contradictions raised and notices of objection (pages 5-15, 51-54 of the student form part III). It is not evident that one of the pages of the two opposition notices paginated from page 1 to 4 is missing, as the applicants claim. Among the documents on educational measures to be collected in the student file is the blame of September 30, 2019 and the “objection” raised against it, as well as the official complaint (supervisory board complaint) (pp. 63 and 66, 67-71 of the student form part III). The handwritten notes on the behavior of the applicant to 2) on August 29 and 30, 2019 (p. 55 of the student form part III) are also a document on the behavior of the student in this sense. With his signature, the class teacher Mr. B ... assumed responsibility for the content of these records. The same applies to the compilation arranged by the class teacher from August 29, 2019 to November 27, 2019 (pages 106-107 of the student form Part III) and to the e-mail from the biology teacher Ms. S ... regarding the applicant's behavior 2) on December 12, 2019 (sheet 110 of the student sheet part III) and the opinion of the school social worker Ms. Z ... on the behavior of the applicant to 2) at school on December 13, 2019 (sheet 111 of the student sheet part III) . <br />
33 <br />
The headmaster's opinion on the official complaint against the school social worker Ms. Z ... (sheet 87 of the student sheet part III) and the minutes of the school aid conference of December 12, 2019 (sheet 108-109 of the student sheet part III) fall under the generic term of "Documents created about the student" in the sense of Section 2 (4) sentence 1 SchuldatenV. From the wording "in particular" it follows that the subsequent list of possible documents to be included in the student file is not exhaustive. <br />
34 <br />
With regard to the handwritten note of classmates, including the drawing of a urinating rhinoceros (p. 61 of the student form part III), the respondent has undertaken to remove them. The urgent request related to this, which has nevertheless been maintained, has become inadmissible. <br />
35 <br />
Insofar as it is noted on sheet 44 of the student sheet part III that the applicants for 1) and 3) viewed the student files on January 17 and 18, 2019 and that certain pages were removed from student sheets I and II, this corresponds the regulation of § 9 paragraph 2 sentence 3 SchuldatenV. Applicants must be admitted that the note is factually related to student sheets I and II. However, it does not seem inappropriate to include the note on the basis of the chronology in the student sheet part III, especially since the student sheets I to III are kept together. In order to fully document the processes of inspecting the student file, the application for applicants 1) and 3) for cleaning up could also be kept (p. 102 of the student file part III). <br />
36 <br />
Furthermore, the applicants have not demonstrated that the student file contains factual information that would be factually incorrect. "Objectively correct" (cf. Art. 5 Para. 1 Letter d) GDPR) is an objective criterion that can only be used for factual information and not for value judgments, according to which the information stored about the person concerned corresponds to reality (cf. Herbst , in: Kühling / Buchner, GDPR BDSG, 2nd edition 2018, Art. 5 GDPR marginal no. 60). Even with regard to the oral criticism of September 30, 2019, which was initially challenged, the applicants did not argue that the underlying facts did not apply, but merely that they were not sufficiently cleared up. <br />
37 <br />
There are no other relevant violations. Purely formal violations of the principles of good record keeping do not mean that the storage and processing of the data contained therein is illegal. Against this background, the applicants' argument that the documents are not arranged in chronological order, that individual sheets are duplicated or only available in duplicate, or that there are pages that are not paginated between the files are irrelevant. Other possible formal inaccuracies, such as a missing signature under the minutes of the class conference on October 10, 2018 (page 5 of the student form part III) or the school aid conference on December 12, 2019 (pages 108-109) do not constitute grounds for the illegality of the data processing in this sense. <br />
38 <br />
A right to erasure from the law on the protection of personal data in the Berlin administration of June 13, 2018 - BlnDSG - [GVBl. 2018, 418]) does not exist. Admittedly, the rules of Section 66 SchulG in conjunction with the SchuldatenV itself do not provide for the right to erasure due to the area exception of Section 2 (8) sentence 1 BlnDSG and are not conclusive in this respect (see Section 2 (8) sentence 2 BlnDSG). However, the BlnDSG does not contain any general right to erasure within the scope of the GDPR. Because the BlnDSG in its new version, as evidenced by the justification of the law, only serves to supplement, clarify and possibly limit the GDPR and not to repeat the provisions contained therein (see House of Representatives of Berlin, printed matter 18/1033 of 9 May 2018, p. 68) . The right to erasure from § 25 BlnDSG only concerns the case of documents from public archives that are not relevant here. The regulation of § 44 BlnDSG is only applicable to matters that are not relevant here the scope of Directive (EU) 2016/680 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in the processing of personal data by the responsible Authorities for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or the execution of sentences, as well as the free movement of data and repeal of Council Framework Decision 2008/977 / JHA (OJ L 119, p. 89). <br />
39 <br />
The Federal Data Protection Act of June 30, 2017 (Federal Law Gazette I p. 2097) - BDSG -, last amended on November 20, 2019 (Federal Law Gazette I p. 1626) does not apply because it does not involve the processing of personal data by public Agency of the federal government or a public agency of the federal states, which carries out federal law or acts as a body of justice, (cf. § 1 para. 1 BDGS). <br />
40 <br />
Since no claim to deletion has already been made credible, the asserted claim to the creation of a clean and newly paginated student file is ruled out from the outset. <br />
41 <br />
For the reasons mentioned above, the requirements for the auxiliary application are not met either. <br />
42 <br />
The decision on costs follows from sections 154 (1) and 159 sentence 1 of the VwGO in conjunction with section 100 (1) ZPO. The determination of the amount in dispute is based on Section 52 (1) and (2) in conjunction with Section 53 (2) No. 1 of the GKG, whereby the amount in dispute must be measured at half the initial value of Section 52 (2) of the GKG in school law urgent proceedings (see OVG Berlin-Brandenburg, decision of April 18, 2013 - OVG 3 S 17.13 - mwN). <br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=VG_Mainz_-_1_K_467/19.MZ&diff=10131VG Mainz - 1 K 467/19.MZ2020-05-06T16:16:52Z<p>Juliette Leportois: </p>
<hr />
<div>{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |VGH Baden-Wüttemberg - 1 S 397/19<br />
|-<br />
| style="padding: 20px;" colspan="2" |[[File:CourtsDE.png|alt=|center|250px]]<br />
|-<br />
|Court:||[[:Category:VG Mainz (Germany)|VG Mainz (Germany)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in Germany|Germany]]<br />
[[Category:VG Mainz (Germany)]]<br />
|-<br />
|Relevant Law:||[[Article 4 GDPR#2|Article 4(2) GDPR]] <br />
[[Category:Article 4(2)GDPR]]<br />
<br />
[[Article 4 GDPR#15|Article 4(15) GDPR]] <br />
[[Category:Article 4(15)GDPR]]<br />
<br />
[[Article 5 GDPR#1|Article 5(1)(a)GDPR]] <br />
[[Category:Article 5(1)(a)GDPR]]<br />
<br />
[[Article 6 GDPR#1|Article 6(1)(a) GDPR]] <br />
[[Category:Article 6(1)(a) GDPR]]<br />
<br />
[[Article 6 GDPR#1|Article 6(1)(b) GDPR]]<br />
[[Category:Article 6(1)(b) GDPR]]<br />
<br />
[[Article 6 GDPR#1|Article 6(1)(f) GDPR]]<br />
[[Category:Article 6(1)(f) GDPR]]<br />
<br />
[[Article 6 GDPR#4|Article 6(4) GDPR]] <br />
[[Category:Article 6(4) GDPR]]<br />
<br />
[[Article 7 GDPR#|Article 7 GDPR]] <br />
[[Category:Article 7 GDPR]]<br />
<br />
[[Article 9 GDPR#1|Article 9(1) GDPR]] <br />
[[Category:Article 9(1) GDPR]]<br />
<br />
[[Article 9 GDPR#2|Article 9(2)(f) GDPR]] <br />
[[Category:Article 9(2)(f) GDPR]]<br />
<br />
[[Article 9 GDPR#2|Article 9(2)(h) GDPR]] <br />
[[Category:Article 9(2)(h) GDPR]]<br />
<br />
[[Article 28 GDPR#|Article 28 GDPR]]<br />
[[Category:Article 28 GDPR]]<br />
<br />
[[Article 9 GDPR#2|Article 58(2)(b) GDPR]] <br />
[[Category:Article 58(2)(b) GDPR]]<br />
<br />
[https://dsgvo-gesetz.de/bdsg/20-bdsg/ § 20 German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG)]<br />
|-<br />
|Decided:||20. 02. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||Veterinarian (anonymous) v. Landesbeauftragten für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI)<br />
|-<br />
|National Case Number:||1 K 467/19.MZ<br />
|-<br />
|European Case Law Identifier:||ECLI:DE:VGMAINZ:2020:0220.1K467.19.00<br />
|-<br />
|Appeal from:||Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI<br />
|-<br />
|Language:||German<br />
[[Category:German]]<br />
|-<br />
|Original Source:||[http://www.landesrecht.rlp.de/jportal/portal/t/51h/page/bsrlpprod.psml;jsessionid=B44E3577658B2ECE6F36ABB73F4AFB30.jp23?doc.hl=1&doc.id=MWRE200001331&documentnumber=1&numberofresults=555&doctyp=juris-r&showdoccase=1&doc.part=L&paramfromHL=true#focuspoint Landesrecht Rheinland-Pfalz]<br />
|}<br />
<br />
The Administrative Court of Mainz ruled that the data required for the collection of claims may be transmitted by a veterinarian to a collection agency on the basis of Art 6(1)(b) and (f) GDPR.<br />
<br />
Further, the abstract possibility alone that information on animal treatment contracts may in special cases be used to draw conclusions about the health of the animal owner does not generally make them health data.<br />
<br />
==English Summary==<br />
<br />
===Facts=== <br />
The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce it. The pet owner's data are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. This is done without the (explicit) consent of the pet owner.<br />
<br />
After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI) which issued a warning under Article 58(2)(b) GDPR, holding that the data transmission from the plaintiff to the VTX did not meet the requirements under the GDPR. Moreover, the LfDI asked the plaintiff to confirm that in the future, he would transfer data of pet owners to VTX only with their prior consent.<br />
<br />
The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate.<br />
<br />
===Dispute===<br />
Three disputes werde adressed from a data protection perspective:<br />
<br />
#Does the transmission of a pet owner's data for claim enforcement purposes from a veterinarian to the VTX, <u>before</u> the VTX accepts an assignment of claims make the VTX the veterinarian's data processor?<br />
#Do data of a pet owner that are transferred from a veterinarian to the VTX consitute health data under Article 4(15) GDPR, since some diseases could be transmitted from animals to humans or from humans to animals (so-called "zoonoses").<br />
#Is the transmission of a pet owner's data from a veterinarian to the VTX lawful under Article 6(1)(b) and (f) GDPR and Article 6(4) GDPR or does such processing require the pet owner's consent?<br />
<br />
===Holding===<br />
The Court held that...<br />
<br />
*... the transmission of a pet owner's data from a veterinarian to the VTX for claim enforcement purposes does not make the VTX a data processor acting on behalf of the veterinarian. This is also the case if the transmission takes place, <u>before</u> the VTX accepts an assignment of claims. The court did not further elaborate the reasons for this holding.<br />
*... data of a pet owner that are transferred from a veterinarian to the VTX do not constitute health data under Article 4(15) GDPR. The abstract possibility alone that in special cases conclusions about the health of the animal owner can be drawn from information on animal treatment contracts (such as accounting documents) does not yet make them health data. Hence, Article 9 GDPR was not applicable.<br />
*... the transmission of a pet owner's data from a veterinarian to the VTX is lawful under Article 6(1)(b) and (f) GDPR. The enforcement of a claim against a pet owner who is in default of payment serves the purpose of the treatment contract, namely the pet owner's obligation to pay the veterinarian's fee. Since the assignment of the claim has not changed the purpose of the contract, Article 6(4) GDPR is not relevant.<br />
*... this data transfer is also lawful under Article 6(1)(f) GDPR as it is necessary to protect the veterinarian's legitimate interest in enforcing his contractual claim with the help of third parties. This interest overrides the pet owner's interest who has violated his contractual obligation to pay.<br />
<br />
==Comment==<br />
''Share your comment here!''<br />
<br />
==Further Resources==<br />
''Share blogs or news articles here!''<br />
<br />
==English Machine Translation of the Decision==<br />
<br />
The decision below is a machine translation of the original. Please refer to the German original for more details.<br />
<br />
<pre>DECISION<br />
<br />
Guiding principle<br />
1. the data required for the enforcement of claims may be transmitted by a veterinarian to a collection agency on the basis of Art. 6 para. 1 sentence 1 lit. b DSGVO or Art. 6 para. 1 sentence 1 lit. f DSGVO However, only those data required for the collection of claims may be transmitted to the collection service provider.<br />
<br />
2) The abstract possibility alone that information on animal treatment contracts - such as accounting documents - may<br />
in special cases be used to draw conclusions about the health of the animal owner does not generally make them health data.<br />
Tenor<br />
The proceedings shall be closed in so far as the parties have unanimously declared that there is no longer any need to adjudicate on the main action as regards point 2 of the decision of 16 April 2019. In all other respects, the notice of 16 April 2019 (No. 1) is revoked.<br />
Orders the defendant to pay the costs.<br />
The judgment shall be provisionally enforceable as regards costs. The defendant is not permitted to avert enforcement by providing security in the amount of the respective enforceable amount unless the plaintiff provides security in the same amount beforehand.<br />
The appeal is allowed.<br />
Facts<br />
1<br />
The plaintiff objects to a warning under data protection law issued by the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate - LfDI -.<br />
2<br />
The plaintiff is a veterinarian and concluded a billing contract and a contract processing agreement with the clearing house for veterinarians - VTX - in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO. According to this directive, the plaintiff can delegate his accounting activities to the association without the express consent of the pet owners who have had their animal treated by the association. Claims of the veterinarian against his patients or the pet owners should be transferred to VTX in accordance with the provisions of the contract if default has occurred and VTX has accepted the transfer. Upon acceptance of the assignment, VTX becomes the owner of the claim. According to the preamble of the Settlement Agreement, VTX shall, prior to the assignment of the receivables, carry out commissioned processing within the meaning of Art. 28 DSGVO, which is further detailed in the Agreement on commissioned processing pursuant to Art. 28 DSGVO. The data of the livestock owners are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims.<br />
3<br />
After a pet owner failed to pay a treatment invoice of the plaintiff dated June 5, 2018 for € 1,001.03 on time, the plaintiff cancelled his self-generated invoice and sent it to VTX on July 3, 2018 for collection. The pet owner had not given his consent to this data transfer and filed a complaint with the LfDI after being requested to pay by VTX.<br />
4<br />
After the hearing of the plaintiff, a warning was issued by decision of 16 April 2019 on the basis of Art. 58 para. 2 lit. b DSGVO. The warning (item 1 of the notice) was justified by the fact that the plaintiff had transferred personal data of an animal keeper to the VTX although the data protection requirements for this had not been met. At the same time, the plaintiff was asked to state (item 2 of the decision) whether he would in future observe the provisions of data protection law in comparable cases and only transfer the data of the pet owners to VTX with their prior consent.<br />
5<br />
The plaintiff filed an action on April 30, 2019. With regard to the declaration required of the plaintiff under item 2 of the notice of 16 April 2019, he first submitted that there was no legal basis for it. However, at the hearing, the defendant reversed paragraph 2 of the decision of 16 April 2019, so that the plaintiff declared the legal dispute to be settled in this respect. With regard to the warning regulated in paragraph 1 of the decision, it was questionable whether this was even a contestable administrative act. In any event, the plaintiff had not violated provisions of the Basic Data Protection Regulation, so that the prerequisites for a warning under Article 58.2 lit. b of the DPA Regulation were not met. Since the pet owner had breached his contractual payment obligations, the plaintiff had been entitled to pass on his data to third parties - in this case: VTX - in order to enforce his claim. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as commissioned data processing. No consent is required for the subsequent assignment after the occurrence of the default. The debtor or pet owner did not have to be asked for his consent if he was in breach of contract and did not meet his payment obligations. It was only a question of whether the transmitted data were suitable and necessary for the Commissioner to be able to fulfil his task (principle of purpose limitation). In this way, the plaintiff had in any event transmitted the relevant data of the animal keeper to VTX in an admissible manner pursuant to Article 6.1 letters b and f, paragraph 4 of the DPA. Moreover, the data transfer was also admissible pursuant to Article 9 DSGVO. These were health data within the meaning of Art. 9 para. 1, Art. 4 no. 15 FADN, since some diseases could be transmitted from animals to humans or from humans to animals (so-called "zoonoses"), so that in some cases, conclusions could be drawn about the health of the keeper even in the case of animal diseases. The plaintiff also points out that consent that meets the strict requirements of Art. 7 DSGVO cannot generally be observed in treatment contracts with doctors and is therefore systematically inappropriate. A further argument in favour of data transmission in conformity with data protection is that it is exempt from punishment under § 203 of the German Criminal Code.<br />
6<br />
The applicant claims that the Court should<br />
7<br />
annul the defendant's decision of 16 April 2019<br />
8<br />
The defendant claims that the Court should<br />
9<br />
dismiss the action.<br />
10<br />
The defendant takes the view that the warning was issued lawfully. According to the applicant, the basic data protection regulation was infringed by the applicant's unlawful transfer of data to the VTX.<br />
11<br />
There is no effective contract for the processing of data within the meaning of Article 28 of the DSGVO which could legitimize the processing of data, since VTX became the owner of the claims with the assignment. Nor did the statutory provisions of Article 6 DSGVO apply in the present case. The transfer of data associated with the assignment was not necessary for the performance of a contract within the meaning of Article 6 (1) (b) DSGVO. While the collection of data by the plaintiff was covered by the contractual relationship existing with the patient or pet owner, this did not apply to the transfer of such data to VTX for collection purposes. The original animal treatment contract did not cover these processing aspects. Nor could the plaintiff invoke a legitimate interest within the meaning of Article 6 (1) (f) of the DSGVO that outweighed the fundamental freedoms of the person concerned. A possible breach of contract on the part of the patient or the pet owner did not entitle the data processing to be extended. Furthermore, the data in question are health data within the meaning of Article 9 DSGVO - irrespective of whether, in a specific individual case, conclusions about the owner can be drawn from this information about the animal's illness. The transfer of data in this case was not justified by Article 9 (2) (f) and (h) DSGVO. According to Art. 9 para. 2 lit. f DSGVO, only own data processing in judicial, extrajudicial or administrative proceedings is permissible; however, this does not include the standard assignment and data transfer in debt collection. The transfer of data was also not permissible under Art. 9 para. 2 lit. h DSGVO because this would have required the consent of the patient or the pet owner. With regard to the request under item 2 of the notice of 16 April 2019, the defendant first stated that it was not a legal obligation of the plaintiff to act, but rather an indication with regard to further procedural steps. The plaintiff had been given the opportunity to comment by the invitation in paragraph 2 of the notice. In the oral hearing, the defendant annulled paragraph 2 of the decision and joined the plaintiff's declaration of completion.<br />
12<br />
For further details of the facts and circumstances of the case, reference is made to the defendant's court file and administrative file (1 booklet), which were before the Chamber and were the subject of the hearing.<br />
Reasons for the decision<br />
13<br />
Insofar as the parties to the proceedings had unanimously declared the proceedings to be settled with regard to point 2 of the contested decision, the proceedings were to be discontinued by analogous application of § 92 para. 3 of the Administrative Court Rules (Verwaltungsgerichtsordnung - VwGO).<br />
14<br />
The action is admissible as regards the remaining point 1 of the contested decision (I.) and is also successful on the merits (II).<br />
15<br />
I. The action is admissible.<br />
16<br />
Pursuant to § 42, Subsection 1, Var. 1, VwGO, the action for rescission is admissible, since the contested warning is an administrative act - at least a declaratory act - within the meaning of § 35, Sentence 1, Administrative Procedure Act - VwVfG - in conjunction with § 1 of the State Administrative Procedure Act - LVwVfG. Finally, the warning states that the addressee has violated the Basic Data Protection Regulation. It is true that the warning does not trigger any concrete, direct legal obligation. Nevertheless, the warning implicitly expresses that the addressee should act in conformity with data protection in the future. Furthermore, the warning is a remedial measure by the data protection authority, which punishes a - albeit regularly rather minor - breach of data protection (see Körffer, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed. 2018, Art. 58, marginal 18; Selmayr, in: Ehmann/Selmayr, 2nd ed. 2018, Basic Data Protection Regulation, Art. 58, marginal 20).<br />
17<br />
The plaintiff is the addressee of an incriminating administrative act (warning; No. 1 of the notice) and is therefore entitled to bring an action within the meaning of § 42 (2) VwGO. According to § 68.1 sentence 2 no. 1 VwGO, § 20.6 BDSG, preliminary proceedings were unnecessary. The one-month period of § 74.1 sentence 1 VwGO was observed. The Administrative Court of Mainz is, pursuant to § 20 (1) and (3) of the Federal Data Protection Act - BDSG - in conjunction with Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO.<br />
18<br />
II. the action is also well founded. The warning issued in number 1 of the decision of 16 April 2019 must be set aside because it is unlawful and infringes the plaintiff's rights (see § 113.1 sentence 1 of the Rules of the Administrative Courts (VwGO)).<br />
19<br />
Pursuant to Art. 58 para. 2 lit. b) FADP, the supervisory authority may issue a warning if a data-processing body has infringed the Regulation. The lawfulness of data processing is governed by Art. 5 et seq. DSGVO.<br />
20<br />
The plaintiff is a data processor because he has transferred data of an animal keeper to VTX. The data transfer is the processing of data within the meaning of § 4 no. 2 DSGVO.<br />
21<br />
This data processing was carried out here lawfully, so that no complaint can be lodged against Art. 5 para. 1 lit. a) DSGVO. It is true that the data processing in dispute here cannot be regarded as commissioned data processing within the meaning of Article 28 DSGVO (1.). However, the data processing was carried out in a permissible manner on the basis of Art. 6 DSGVO (2.). The increased requirements, which according to Art. 9 DSGVO are made on the processing of special categories of personal data, did not have to be observed in the present case (3.).<br />
22<br />
1. in the present case, the transfer of data of the animal keeper concerned from the plaintiff to the VTX did not take place within the framework of commissioned data processing pursuant to Art. 28 DSGVO The procedure, according to which the transfer of the data from the veterinary surgeon to the clearing and collection agency prior to the assignment of the claim would in principle have to be assessed as commissioned processing, would not only constitute a contract to the detriment of third parties and would constitute a circumvention of the actually relevant, stricter requirements of Art. 6 et seq. DSGVO for a data transfer to a third party not bound by instructions, but above all is in fact not to be assessed as contract processing.<br />
23<br />
The first argument against the assignment of claims and the fact that VTX is bound by instructions is that the assignment - which, according to the plaintiff, causes VTX as the responsible party to switch from processing orders to data processing - is ultimately based on a free decision by VTX (see also the preamble of the settlement agreement): according to the agreement, the assignment of claims necessarily requires a declaration of acceptance by VTX. The far-reaching changes to data protection law intended by the plaintiff, which are to be initiated by the assignment, are thus not under the control of the party responsible.<br />
24<br />
It is true that the applicant may have transferred the data in its possession to the VTX at a time when the assignment was not yet effective. However, the VTX still had access to the data even after the assignment had taken place. It did not process them until after the assignment as the holder of the claim and appeared before the pet owner concerned with its own invoice for the treatment costs. This data processing was not carried out on behalf of the plaintiff because the plaintiff assigned its claims against the pet owner to VTX in accordance with the contract. As assignee, VTX can independently enforce the claim against the pet owner and process the data in its possession independently and without instruction. The plaintiff has no authority to issue instructions to VTX after the assignment has been made on the basis of the contract (see also Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 136; Ziegenhorn/Fokken, ZD 2019, 194).<br />
25<br />
Insofar as the factual requirements of Art. 28 DSGVO are not met, it is irrelevant whether the VTX is to be regarded as a processor under the settlement agreement concluded with the plaintiff at the time of the data transfer.<br />
26<br />
2. the transmission of data of the animal keeper by the plaintiff to the VTX was lawful pursuant to Art. 6(1) sentence 1 lit. b DSGVO (a)) and Art. 6(1) sentence 1 lit. f DSGVO (b)) respectively<br />
27<br />
a) The data transmission, which here took place within the framework of an assignment to TVG as the collection agency, is permissible pursuant to Art. 6 Para. 1 Sentence 1 lit. b DSGVO.<br />
28<br />
On this legal basis, data transmission may be permissible irrespective of the conduct of the data subject - in particular without consent within the meaning of Art. 6 para. 1 sentence 1 lit. a, Art. 7 DSGVO. Finally, the elements of admissibility contained in Art. 6 para. 1 DSGVO are equivalent in terms of their legal function and apply side by side without it being necessary to assume a tiered relationship. It cannot be concluded from the enumeration of the various admissibility elements that consent under Article 6.1 sentence 1 lit. a DSGVO is a prior-ranking admissibility element and that, for example, the general weighing of interests under Article 6.1 sentence 1 lit. f DSGVO must be understood as the ultima ratio. In this respect, the statutory grounds for authorisation take account not only of the data protection interests of the data subjects, but also of the recognisable interests of the controller in data processing that is permissible by way of exception (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Article 6, marginal no. 10). Article 6(1) sentence 1(b) DSGVO allows the controller to process data within the limits of the contract concluded in each case; further protection beyond a weighing of interests is not necessary because the data subject, as a contracting party, has decided to conclude the contract and the associated rights and obligations (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 29; Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. status 1 November 2019, Art. 6, marginal 29).<br />
29<br />
According to Art. 6 para. 1 sentence 1 lit. b DPA, data processing - which is in principle unlawful - is lawful (prohibition subject to authorisation), inter alia, if the processing is necessary for the performance of a contract to which the data subject is a party. In principle, all contracts relating to data processing can be covered by this provision (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal no. 28).<br />
30<br />
The contract, the performance of which is at stake, must have been concluded with the person whose data are processed. It is not necessary that the contractual partner of the data subject and the controller processing the data are the same person. Therefore, on the basis of Art. 6 para. 1 sentence 1 lit. b DSGVO, data processing by uninvolved third parties is also legitimised if it is necessary for the performance of a contract to which the data subject is a party (cf. Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. Status 1 November 2019, Art. 6, marginal no. 30). In the present case, the plaintiff and the pet owner affected by the data processing have concluded a treatment contract for the horses of the pet owner.<br />
31<br />
However, data processing pursuant to Art. 6 para. 1 sentence 1 lit. b DSGVO is only permissible if it is necessary for contractual purposes. This is usually the case if the essentialia negotii of the respective contract are affected. However, no excessively strict requirements are placed on the necessity of data processing: A data processing is not only necessary for the fulfilment of the contract if the contract could not be carried out without the data processing; rather, it is sufficient if the data processing is objectively reasonable with regard to the purpose of the contract (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal no. 38; Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. status 1 November 2019, Art. 6, marginal no. 32).<br />
32<br />
The main performance obligations of the treatment contract concluded here included the plaintiff's obligation to provide veterinary treatment and the obligation of the pet owner to pay the veterinary surgeon's fee. The pet owner did not comply with this obligation and did not pay the invoice amount of € 1,001.03 within the payment period. The enforcement of this claim serves the purpose of the treatment contract. In doing so, there is no legal objection if the owner of the claim - here: the plaintiff as a veterinarian - assigns the claims to a third party - here: VTX - as a collection agency for the purpose of making the claim management more effective. In accordance with the provisions of the German Civil Code (BGB), the assignment as such does not require the debtor's consent in order to be effective, provided that this does not violate a statutory prohibition pursuant to § 134 BGB. However, the validity of the assignment is not relevant for the question whether an inadmissible data transfer has taken place.<br />
33<br />
The data required for the debt enforcement by the collection agency could be transmitted here. After all, data transfer is a necessary means to an end: the aim is to be able to collect the due claim from the debtor. Without the necessary information, the transferred claim would be useless for the assignee (see Lehmann/Wancke, WM 2019, 613 [615; 618]; Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, margin no. 136; Abel/Djagani, ZD 2017, 114 [117]). However, only those data required for debt collection may be transmitted to the collection service provider. The fact that the plaintiff transferred more data than would have been necessary for the performance of the contract was not accused by the plaintiff and not alleged by the defendant.<br />
34<br />
Since the assignment of the claim has not changed the purpose of the contract, Art. 6 para. 4 DSGVO is not relevant (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, margin no. 136; Abel/Djagani, ZD 2017, 114 [117]). Finally, even after the assignment, the main contractual obligation of the animal keeper should be enforced and not new objectives, such as advertising purposes, should be pursued.<br />
35<br />
b) In any case, the data transfer here is (also) lawful under Art. 6 para. 1 sentence 1 lit. f DSGVO. According to this, the processing of data is permissible if this is necessary to safeguard the legitimate interests of the controller or of a third party, provided that the interests or fundamental rights and freedoms of the data subject which require the protection of personal data do not prevail. On this basis, the legitimate interests of the controller must be weighed against the interests of the data subject.<br />
36<br />
The balance of interests is in favour of the plaintiff. The transfer of the data to VTX was necessary here to protect his legitimate interests. As a veterinarian, the plaintiff has a legitimate - legal and economic - interest in his veterinary services being remunerated by the respective animal owners. If a pet owner does not meet his contractual obligation to perform, the veterinarian also has a legitimate interest in enforcing his contractual claim with the help of third parties. This is a normal reaction of the responsible person to the behaviour of a third party in breach of contract (see Wolff, in: Schantz/Wolff, Das neue Datenschutzrecht, 1st ed. 2017, marginal no. 668).<br />
37<br />
Predominant interests of the animal keeper affected by the data transfer do not conflict with this interest of the veterinarian: Finally, the animal keeper has himself contributed to the fact that the data transfer became necessary for the collection of the claim by violating his contractual obligation to pay (see Conrad/Dovas, in: Forgó/Helfrich/Schneider, Betrieblicher Datenschutz, Part IX, Chapter 2, marginal no. 105; Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 136).<br />
38<br />
3 Whether the data transfer here is lawful under Art. 9 DSGVO can be left open. The Chamber assumes that the data transmitted here by the plaintiff are not health data within the meaning of Art. 4 No. 15 DSGVO. Accordingly, "health data" are personal data relating to the physical or mental health of a natural person, including the provision of health services, and from which information on his or her state of health can be deduced.<br />
39<br />
The present case concerns 'health data' of the animals treated by the plaintiff under veterinary supervision. The fee invoice that the plaintiff has sent to VTX for collection of the claim also provides information on the health of the animals. However, this is not data relating to the health of a natural person, so it is not specifically protected by the provision in Art. 9 DSGVO. The parties concerned have not submitted that the present case concerned animal diseases that can be transmitted to humans and thus to the affected animal owner and can affect his health, or that diseases were affected that are transmitted from humans to animals (so-called "zoonoses"). The abstract possibility alone that in special cases conclusions about the health of the animal owner can be drawn from information on animal treatment contracts - such as accounting documents - does not yet make them health data (see LG Dortmund, judgement of 9 February 2006 - 4 S 176/05 -, juris, marginal no. 16 ff.; a.A. LG Bochum, judgement of 25 November 1992 - 10 S 42/92 - beck-online).<br />
40<br />
If, on the other hand, information on the debtor - animal owner - has been transmitted because it is relevant for the enforcement of the claim (e.g. name and address), this is not particularly sensitive data under Art. 9 DSGVO.<br />
41<br />
Criminal relevance is irrelevant to the question of whether there is a violation of data protection law that is objectionable.<br />
42<br />
As regards the contested part, the decision on costs is based on Paragraph 154 of the VwGO, and the remainder follows from Paragraph 161(2) of the VwGO.<br />
43<br />
Pursuant to § 161 (2) VwGO, the costs of the proceedings are to be decided by order, taking into account the previous state of affairs and the state of the dispute, at equitable discretion.<br />
44<br />
As a rule, it is equitable discretion to order the costs of the proceedings to be borne by the party which, without settlement, would probably have been unsuccessful in a merely summary examination of the factual and legal situation or which has brought about settlement of the legal dispute of its own volition (see BVerwG, order of 2 February 2006 - 1 C 4/05 -, juris para. 2; VGH BW, order of 26 July 2011 - 10 S 1368/10 -, juris para. 2; refusal to bring about settlement: Kopp/Schenke, VwGO, 24th ed. 2018, para. 161 marginal no. 17). If the outcome of the proceedings cannot be predicted on the basis of a merely summary examination - i.e. if the prospects of success are open - it is reasonable discretion to distribute the costs of the proceedings appropriately between the parties in accordance with § 155.1 VwGO (see BVerwG, decision of 2 February 2006, loc. cit.)<br />
45<br />
In the present case, there is some evidence to suggest that the action would already have been dismissed as inadmissible in respect of paragraph 2 of the decision. In this respect, it should not be a question of a challengeable administrative act which creates a legal obligation on the part of the plaintiff as the addressee. With the "regulation" in point 2, the defendant alone wanted to prepare further measures and announce them to the plaintiff. In any case, the plaintiff was not in need of legal protection - irrespective of the quality of the administrative act - because it was only an official procedural act within the meaning of § 44a VwGO (German Rules of the Administrative Courts) which cannot be challenged independently. Nevertheless, applying the legal concept of § 155.1 sentence 3 VwGO, it is in accordance with the principle of equitable discretion to order the defendant to pay all the costs. The challenge of number 2 of the ruling is only a subordinate annex to the challenge of number 2 of the ruling, which is the relevant subject of the dispute.<br />
46<br />
The decision on the provisional enforceability of the judgment with regard to costs follows from § 167 VwGO in conjunction with §§ Sections 708 et seq. ZPO.<br />
47<br />
Insofar as the proceedings have been discontinued and a decision has been made in this regard on the bearing of costs, this decision is unappealable (§ 92 (3) sentence 2 VwGO in conjunction with § 158 (2) VwGO).<br />
48<br />
In all other respects, the appeal is dismissed pursuant to § 124a para. 1 sentence 1 VwGO in conjunction with § 124a (2) no. 3 VwGO, because the Chamber considers the case to be of fundamental importance. In this respect, the information on legal remedies printed below applies.<br />
Order of the 1st Chamber of the Administrative Court of Mainz of 20 February 2020<br />
49<br />
The value of the subject matter of the dispute is set at €5,000 (§ 52(1) and (2) of the Gerichtskostengesetz - GKG).<br />
<br />
<br />
<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CE_-_N%C2%B0_431350&diff=10126CE - N° 4313502020-05-04T15:57:01Z<p>Juliette Leportois: /* Holding */</p>
<hr />
<div>The Supreme Administrative Court of France (Conseil d'Etat "CE") has ruled that the processing of personal data of persons in psychiatric care without their consent for the prevention of terrorist radicalization does not fall within the GDPR scope. <br />
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |CE - N° 431350<br />
|-<br />
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:Conseil_D'Etat_photo.png|center|150px|link=Special:FilePath/Conseil_D'Etat_photo.png]]<br />
|-<br />
|Court:||[[:Category:CE (France)|CE (France)]]<br />
[[Category:CE (France)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in France|France]]<br />
[[Category:France]]<br />
|-<br />
|Relevant Law:||[[Category:Article 2(2) GDPR|Article 2 GDPR#2]]<br />
[[Article 2 GDPR#2a|Article 2(2)(a) GDPR]]<br />
|-<br />
|Decided:||27. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||CRPA, LDH and MGEN ASS Vs. French Republic<br />
|-<br />
|National Case number:||N° 431350<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:FR:CECHR:2020:431350.20200327</small><br />
|-<br />
|Appeal from:||CE acting as the first and last instance<br />
|-<br />
|Language:||French<br />
[[Category:French]]<br />
|-<br />
|Original Source:||[https://www.legifrance.gouv.fr/affichJuriAdmin.do?oldAction=rechJuriAdmin&idTexte=CETATEXT000041785967&fastReqId=662954110&fastPos=1 Légifrance(in FR)]<br />
|}<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, ''inter alia'', the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority.<br />
<br />
The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law.<br />
<br />
The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR.<br />
<br />
===Dispute===<br />
The Court had to assess which legal was applicable and whether the further processing is lawful.<br />
<br />
===Holding===<br />
<br />
The Supreme Administrative Court decided<br />
<br />
First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté)<br />
<br />
Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment<br />
<br />
Fourthly, the Court ruled that personal data related to health are lawfully processed for public interests.<br />
<br />
Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected.<br />
<br />
Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure.<br />
<br />
As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.<br />
<br />
==Comment==<br />
''Share your comment on the decision here!'' <br />
<br />
==Further Resources==<br />
''Share other blogs or news articles here!''<br />
<br />
See the CNIL's summary and comments [https://www.cnil.fr/fr/droit-au-dereferencement-le-conseil-detat-tire-les-consequences-des-arrets-de-la-cour-de-justice-de here]. <br />
<br />
==English Machine Translation of the Decision==<br />
<br />
<pre><br />
References<br />
Council of State<br />
<br />
N° 431350 <br />
ECLI:EN:CECHR:2020:431350.20200327<br />
Mentioned in the tables of the Lebon collection<br />
10th - 9th bedrooms combined<br />
Mrs Isabelle Lemesle, Rapporteur<br />
Mr Alexandre Lallet, public rapporteur<br />
<br />
<br />
reading of Friday 27 March 2020<br />
FRENCH REPUBLIC<br />
<br />
ON BEHALF OF THE FRENCH PEOPLE<br />
<br />
<br />
Full text<br />
Having regard to the following procedures:<br />
<br />
1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State:<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State :<br />
<br />
1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State :<br />
<br />
1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State :<br />
<br />
1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018;<br />
<br />
3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling;<br />
<br />
4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to :<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
....................................................................................<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
In view of the other parts of the files ;<br />
<br />
Seen:<br />
- the European Convention for the Protection of Human Rights and Fundamental Freedoms;<br />
- the Charter of Fundamental Rights of the European Union;<br />
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ;<br />
- the Public Health Code ;<br />
- the Internal Security Code ;<br />
- Law No. 78-17 of 6 January 1978;<br />
- the code of administrative justice;<br />
<br />
<br />
After hearing in public session:<br />
<br />
- the report of Mrs. Isabelle Lemesle, State Councillor;<br />
<br />
- the conclusions of Mr. Alexandre Lallet, Maître des requêtes;<br />
<br />
The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians;<br />
Considering the following:<br />
<br />
1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision.<br />
<br />
On the conclusions directed against the decree of 23 May 2018:<br />
<br />
2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)".<br />
<br />
3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible.<br />
<br />
On the conclusions directed against the decree of 6 May 2019:<br />
<br />
4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed.<br />
<br />
With regard to the admissibility of applications :<br />
<br />
5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree.<br />
<br />
6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree.<br />
<br />
As regards the intervention of UNAFAM :<br />
<br />
7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350.<br />
<br />
As regards the legality of the contested decree :<br />
<br />
8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted.<br />
<br />
9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016.<br />
<br />
11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded.<br />
<br />
12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed.<br />
<br />
13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree.<br />
<br />
14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him".<br />
<br />
15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed.<br />
<br />
16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative.<br />
<br />
17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed.<br />
<br />
18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions.<br />
<br />
19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits.<br />
<br />
20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter.<br />
<br />
21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings.<br />
<br />
<br />
<br />
<br />
D E C I D E :<br />
--------------<br />
Article 1: The intervention of UNAFAM is admitted.<br />
Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected.<br />
<br />
Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health.<br />
Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:CE_(France)&diff=10125Category:CE (France)2020-05-04T15:56:18Z<p>Juliette Leportois: </p>
<hr />
<div>Here you can find all decisions of the Supreme Administrative Court of France (''Conseil d' Etat'').<br />
[[Category:French Court Decisions]]</div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CE_-_N%C2%B0_431350&diff=10124CE - N° 4313502020-05-04T15:56:05Z<p>Juliette Leportois: </p>
<hr />
<div>The Supreme Administrative Court of France (Conseil d'Etat "CE") has ruled that the processing of personal data of persons in psychiatric care without their consent for the prevention of terrorist radicalization does not fall within the GDPR scope. <br />
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |CE - N° 431350<br />
|-<br />
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:Conseil_D'Etat_photo.png|center|150px|link=Special:FilePath/Conseil_D'Etat_photo.png]]<br />
|-<br />
|Court:||[[:Category:CE (France)|CE (France)]]<br />
[[Category:CE (France)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in France|France]]<br />
[[Category:France]]<br />
|-<br />
|Relevant Law:||[[Category:Article 2(2) GDPR|Article 2 GDPR#2]]<br />
[[Article 2 GDPR#2a|Article 2(2)(a) GDPR]]<br />
|-<br />
|Decided:||27. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||CRPA, LDH and MGEN ASS Vs. French Republic<br />
|-<br />
|National Case number:||N° 431350<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:FR:CECHR:2020:431350.20200327</small><br />
|-<br />
|Appeal from:||CE acting as the first and last instance<br />
|-<br />
|Language:||French<br />
[[Category:French]]<br />
|-<br />
|Original Source:||[https://www.legifrance.gouv.fr/affichJuriAdmin.do?oldAction=rechJuriAdmin&idTexte=CETATEXT000041785967&fastReqId=662954110&fastPos=1 Légifrance(in FR)]<br />
|}<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, ''inter alia'', the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority.<br />
<br />
The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law.<br />
<br />
The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR.<br />
<br />
===Dispute===<br />
The Court had to assess which legal was applicable and whether the further processing is lawful.<br />
<br />
===Holding===<br />
<br />
The Supreme Administrative Court decided<br />
<br />
First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté)<br />
<br />
Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment<br />
<br />
Fourthly, The Court ruled that personal data related to health are lawfully processed for public interests.<br />
<br />
Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected.<br />
<br />
Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure.<br />
<br />
As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.<br />
<br />
==Comment==<br />
''Share your comment on the decision here!'' <br />
<br />
==Further Resources==<br />
''Share other blogs or news articles here!''<br />
<br />
See the CNIL summary and comment [https://www.cnil.fr/fr/droit-au-dereferencement-le-conseil-detat-tire-les-consequences-des-arrets-de-la-cour-de-justice-de here]. <br />
<br />
==English Machine Translation of the Decision==<br />
<br />
<pre><br />
References<br />
Council of State<br />
<br />
N° 431350 <br />
ECLI:EN:CECHR:2020:431350.20200327<br />
Mentioned in the tables of the Lebon collection<br />
10th - 9th bedrooms combined<br />
Mrs Isabelle Lemesle, Rapporteur<br />
Mr Alexandre Lallet, public rapporteur<br />
<br />
<br />
reading of Friday 27 March 2020<br />
FRENCH REPUBLIC<br />
<br />
ON BEHALF OF THE FRENCH PEOPLE<br />
<br />
<br />
Full text<br />
Having regard to the following procedures:<br />
<br />
1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State:<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State :<br />
<br />
1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State :<br />
<br />
1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State :<br />
<br />
1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018;<br />
<br />
3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling;<br />
<br />
4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to :<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
....................................................................................<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
In view of the other parts of the files ;<br />
<br />
Seen:<br />
- the European Convention for the Protection of Human Rights and Fundamental Freedoms;<br />
- the Charter of Fundamental Rights of the European Union;<br />
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ;<br />
- the Public Health Code ;<br />
- the Internal Security Code ;<br />
- Law No. 78-17 of 6 January 1978;<br />
- the code of administrative justice;<br />
<br />
<br />
After hearing in public session:<br />
<br />
- the report of Mrs. Isabelle Lemesle, State Councillor;<br />
<br />
- the conclusions of Mr. Alexandre Lallet, Maître des requêtes;<br />
<br />
The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians;<br />
Considering the following:<br />
<br />
1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision.<br />
<br />
On the conclusions directed against the decree of 23 May 2018:<br />
<br />
2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)".<br />
<br />
3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible.<br />
<br />
On the conclusions directed against the decree of 6 May 2019:<br />
<br />
4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed.<br />
<br />
With regard to the admissibility of applications :<br />
<br />
5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree.<br />
<br />
6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree.<br />
<br />
As regards the intervention of UNAFAM :<br />
<br />
7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350.<br />
<br />
As regards the legality of the contested decree :<br />
<br />
8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted.<br />
<br />
9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016.<br />
<br />
11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded.<br />
<br />
12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed.<br />
<br />
13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree.<br />
<br />
14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him".<br />
<br />
15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed.<br />
<br />
16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative.<br />
<br />
17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed.<br />
<br />
18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions.<br />
<br />
19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits.<br />
<br />
20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter.<br />
<br />
21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings.<br />
<br />
<br />
<br />
<br />
D E C I D E :<br />
--------------<br />
Article 1: The intervention of UNAFAM is admitted.<br />
Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected.<br />
<br />
Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health.<br />
Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=CE_-_N%C2%B0_431350&diff=10123CE - N° 4313502020-05-04T15:55:37Z<p>Juliette Leportois: </p>
<hr />
<div>The French Supreme Administrative Court (Conseil d'Etat "CE") has ruled that the processing of personal data of persons in psychiatric care without their consent for the prevention of terrorist radicalization does not fall within the GDPR scope. <br />
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"<br />
! colspan="2" |CE - N° 431350<br />
|-<br />
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:Conseil_D'Etat_photo.png|center|150px|link=Special:FilePath/Conseil_D'Etat_photo.png]]<br />
|-<br />
|Court:||[[:Category:CE (France)|CE (France)]]<br />
[[Category:CE (France)]]<br />
|-<br />
|Jurisdiction:||[[Data Protection in France|France]]<br />
[[Category:France]]<br />
|-<br />
|Relevant Law:||[[Category:Article 2(2) GDPR|Article 2 GDPR#2]]<br />
[[Article 2 GDPR#2a|Article 2(2)(a) GDPR]]<br />
|-<br />
|Decided:||27. 03. 2020<br />
[[Category:2020]]<br />
|-<br />
|Published:||n/a<br />
|-<br />
|Parties:||CRPA, LDH and MGEN ASS Vs. French Republic<br />
|-<br />
|National Case number:||N° 431350<br />
|-<br />
|European Case Law Identifier:||<small>ECLI:FR:CECHR:2020:431350.20200327</small><br />
|-<br />
|Appeal from:||CE acting as the first and last instance<br />
|-<br />
|Language:||French<br />
[[Category:French]]<br />
|-<br />
|Original Source:||[https://www.legifrance.gouv.fr/affichJuriAdmin.do?oldAction=rechJuriAdmin&idTexte=CETATEXT000041785967&fastReqId=662954110&fastPos=1 Légifrance(in FR)]<br />
|}<br />
<br />
==English Summary==<br />
<br />
===Facts===<br />
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, ''inter alia'', the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority.<br />
<br />
The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law.<br />
<br />
The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR.<br />
<br />
===Dispute===<br />
The Court had to assess which legal was applicable and whether the further processing is lawful.<br />
<br />
===Holding===<br />
<br />
The Supreme Administrative Court decided<br />
<br />
First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté)<br />
<br />
Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment<br />
<br />
Fourthly, The Court ruled that personal data related to health are lawfully processed for public interests.<br />
<br />
Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected.<br />
<br />
Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure.<br />
<br />
As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.<br />
<br />
==Comment==<br />
''Share your comment on the decision here!'' <br />
<br />
==Further Resources==<br />
''Share other blogs or news articles here!''<br />
<br />
See the CNIL summary and comment [https://www.cnil.fr/fr/droit-au-dereferencement-le-conseil-detat-tire-les-consequences-des-arrets-de-la-cour-de-justice-de here]. <br />
<br />
==English Machine Translation of the Decision==<br />
<br />
<pre><br />
References<br />
Council of State<br />
<br />
N° 431350 <br />
ECLI:EN:CECHR:2020:431350.20200327<br />
Mentioned in the tables of the Lebon collection<br />
10th - 9th bedrooms combined<br />
Mrs Isabelle Lemesle, Rapporteur<br />
Mr Alexandre Lallet, public rapporteur<br />
<br />
<br />
reading of Friday 27 March 2020<br />
FRENCH REPUBLIC<br />
<br />
ON BEHALF OF THE FRENCH PEOPLE<br />
<br />
<br />
Full text<br />
Having regard to the following procedures:<br />
<br />
1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State:<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State :<br />
<br />
1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State :<br />
<br />
1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State :<br />
<br />
1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ;<br />
<br />
2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018;<br />
<br />
3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling;<br />
<br />
4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
<br />
....................................................................................<br />
<br />
5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to :<br />
<br />
1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ;<br />
<br />
2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.<br />
<br />
....................................................................................<br />
<br />
<br />
....................................................................................<br />
<br />
<br />
In view of the other parts of the files ;<br />
<br />
Seen:<br />
- the European Convention for the Protection of Human Rights and Fundamental Freedoms;<br />
- the Charter of Fundamental Rights of the European Union;<br />
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ;<br />
- the Public Health Code ;<br />
- the Internal Security Code ;<br />
- Law No. 78-17 of 6 January 1978;<br />
- the code of administrative justice;<br />
<br />
<br />
After hearing in public session:<br />
<br />
- the report of Mrs. Isabelle Lemesle, State Councillor;<br />
<br />
- the conclusions of Mr. Alexandre Lallet, Maître des requêtes;<br />
<br />
The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians;<br />
Considering the following:<br />
<br />
1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision.<br />
<br />
On the conclusions directed against the decree of 23 May 2018:<br />
<br />
2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)".<br />
<br />
3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible.<br />
<br />
On the conclusions directed against the decree of 6 May 2019:<br />
<br />
4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed.<br />
<br />
With regard to the admissibility of applications :<br />
<br />
5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree.<br />
<br />
6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree.<br />
<br />
As regards the intervention of UNAFAM :<br />
<br />
7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350.<br />
<br />
As regards the legality of the contested decree :<br />
<br />
8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted.<br />
<br />
9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued.<br />
<br />
10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016.<br />
<br />
11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded.<br />
<br />
12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed.<br />
<br />
13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree.<br />
<br />
14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him".<br />
<br />
15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed.<br />
<br />
16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative.<br />
<br />
17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed.<br />
<br />
18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions.<br />
<br />
19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits.<br />
<br />
20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter.<br />
<br />
21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings.<br />
<br />
<br />
<br />
<br />
D E C I D E :<br />
--------------<br />
Article 1: The intervention of UNAFAM is admitted.<br />
Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected.<br />
<br />
Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health.<br />
Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.<br />
</pre></div>Juliette Leportoishttps://gdprhub.eu/index.php?title=Category:CE_(France)&diff=10122Category:CE (France)2020-05-04T15:54:54Z<p>Juliette Leportois: </p>
<hr />
<div>Here you can find all decisions of the French Supreme Administrative Court (''Conseil d' Etat'').<br />
[[Category:French Court Decisions]]</div>Juliette Leportois