VGH München - 12 B 19.1648

BayVGH - 12 B 19.1648
Court:	VGH München (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(c) GDPR Article 6(2) GDPR Article 6(2) GDPR Article 6(3) GDPR Article 5 (1) Directive 2015/1535/EU Article 2 (1), Article 1 (1) Grundgesetz - GG (German Basic Law) Article 3 (1) Zweckentfremdungsgesetz - ZwEWG (Bavarian misappropriation of property law) § 12 (1) Satzung über das Verbot der Zweckentfremdung von Wohnraum - ZeS (Statute on the prohibition of misappropriation of housing) § 14 (II) Telemediengesetz - TMG (Telemedia Law) § 3 (II), (V) Telemediengesetz - TMG (Telemedia Law) § 15 (V) Telemediengesetz - TMG (Telemedia Law)
Decided:	20.05.2020
Published:
Parties:
National Case Number/Name:	12 B 19.1648
European Case Law Identifier:
Appeal from:	VG München (Germany) M 9 K 18.4553
Appeal to:
Original Language(s):	German
Original Source:	Bayerische Staatskanzlei (in German)
Initial Contributor:	Maria Lohmann

The Bavarian Administrative Court held that with regard to the exchange of personal data between a controller and an authority acting in its governmental capacity, one must distinguish between the legal basis for the transfer of data by the controller on the one hand and the legal basis for receiving the personal data on the other.

English Summary

Facts

An Irish provider of an online vacation rental marketplace was asked by a Bavarian authority to transfer data of its users who are renting out their appartments for vacation purposes. The purpose was to fight the misappropriation of property in a tight housing market. The request was restricted to uses of an appartment for the purpose of providing accommodation for a period of more than 8 weeks in a calendar year.

Dispute

Is a request - not limited to the individual case - for the provision of information on all users of an online vacation rental marketplace who rent out their appartment for more than 8 weeks a calender year in order to fight shortage of living space by misappropriation of property possible and on what legal basis can a data transfer between the company and the requesting authority be based.

Holding

The service provider must and may only provide information on the basis of Section 14 (2) of the German Telemedia Act if this provision entitles the service provider to provide information itself and if the requesting authority can also provide a corresponding, precisely tailored authorisation under special law for the right to information, transmission and receipt of data. If these conditions are not cumulatively fulfilled, the service provider cannot provide information.

The "data protection opening clause" of Section 14 (2) of the German Telemedia Act (TMG) expressly permits the service provider to provide information only "in individual cases" and not based on broad screening criteria which would lead to the disclosure of uninvolved persons who may already have a permission granted by an authority to rent out their appartment. However, this would in each case presuppose a concrete initial suspicion relating to persons or accommodation.

The fact of occasional, perhaps even multiple, short term or long term rentals, will typically not be sufficient to assume misuse without further indications of illegal activity. This is regardless of whether the rental is listed only under a first name or a pseudonym.

Comment

Of particular interest are also paras 98 and 99, which address the interplay between national data protection law and the country of origin principle.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

VGH Munich, decision of 20.05.2020 - 12 B 19.1648Title:Right to information according to the right of misuse against service providers within the meaning of the TelemediengesetzNormenketten:TMG § 14 Abs. 2ZwEWG Art. 3 Abs. 1, S. 1, S. 3, S. 5ZeS § 12 Abs. 1 S. 1 Hs. 1, S. 2, p. 4Guidelines:1 In regulating data exchange for the performance of governmental tasks, a strict distinction must be made between data transmission by the information-providing body and data retrieval by the information-requesting body. The exchange of data takes place through the corresponding interferences of retrieval and transmission, each of which requires its own legal basis. The (respective) legislator must therefore, figuratively speaking, not only open the door to the transmission of data, but also the door to their retrieval. Only the two legal bases together, which must work together and interlock like a "double door", as it were, can legitimise an exchange of personal data (following BVerfGE 130, 151 [184]). (recital 46)2. § Article 14.2 and Article 15.5 sentence 4 in conjunction with In this respect, § 14.2 of the Telemedia Act does not constitute a separate basis for authorisation for information, but merely the "opening clause under data protection law" for the service provider to provide information at all if the requesting authority requests information on the basis of a statutory basis for authorisation - Article 3.1 sentences 1, 3 and 5 of the ZwEWG; § 12.1 sentence 1 half 1, sentence 2 and sentence 4 of the ZeS. (para. 51)3. The service provider must and may only provide information on the basis of Section 14 (2) of the German Telemedia Act if this provision entitles the service provider to provide information itself and if the requesting authority can also provide a corresponding, precisely tailored authorisation under special law for the right to information, transmission and receipt of data. If these conditions are not cumulatively fulfilled, the service provider cannot provide information. (Recital 51)4. The "data protection opening clause" of § 14 (2) of the German Telemedia Act (TMG), which is contoured by federal law, expressly permits the service provider to provide information only "in individual cases". Under the validity of the Basic Law, the principle of the rule of law obliges all law-making bodies of the Federal Government and the Länder to coordinate their regulations in each case in such a way that the norm addressees do not achieve opposing regulations that make the legal system contradictory. Conceptual decisions of the competent federal legislator must not be distorted or even undermined by decisions of a Land legislator based on special competences. To avoid contradiction with the higher-ranking federal provision of Section 14 (2) TMG, the provisions of Art. 3 (1) sentences 1, 3 and 5 ZwEWG; Section 12 (1) sentences 1, half (1) and 4 ZeS must therefore be interpreted and applied in such a way that they also only permit the retrieval of personal data "in individual cases". (marginals 65 and 66)5. By using the constituent element "in individual cases", the (federal) legislator has permanently excluded a general and comprehensive obligation to provide information without cause, based on mere speculation, and has deliberately set the threshold of intervention high, because the epitome of a free community includes the fact that citizens can move freely - also on the Internet - without having to be registered by the state at will, without having to give evidence of their integrity and without being exposed to the feeling of being constantly monitored. (margin no. 82)6 The defendant must therefore restrict itself to applying Art. 3 (1) sentences 1, 3 and 5 ZwEWG; Section 12 (1) sentence 1 half 1, sentence 2 and sentence 4 ZeS and Section 14 (2) TMG "in individual cases", which presupposes a concrete initial suspicion relating to a person or property. A 
general and area-wide "data collection on stock" is not an option Neither the Basic Law nor simple federal or state law gives the defendant the authority to subject the legal compliance of its citizens to a general control "into the blue" without the existence of a concrete initial suspicion relating to persons or objects. (para. 91)7 The mere fact of an occasional, possibly also multiple, short or even long-term letting or transfer of use - even if it is exclusively using a first name or pseudonym without any further address or address - is not sufficient to justify the assumption of a concrete initial suspicion in view of the manifold possibilities of a completely legal (authorised) use without the occurrence of further circumstances clearly indicating a misuse. In fact, therefore, a concrete object-related connecting factor to be named by the defendant (specific apartment) will always be required in order to legitimise a request for information in an individual case after prior examination of the absence of an authorisation. (para. 92)Keywords:Right to information under the law on misappropriation against service providers within the meaning of the Telemedia Act, TMG, right to information, misappropriation of purpose, service providers, data exchange, information, informational self-determination, data transmission, data retrieval, data retrieval, initial suspicionPrior instance:VG Munich, judgement of 12.12.2018 - M 9 K 18.4553Fundstelle:BeckRS 2020, 10398TenorI. The judgement of the Administrative Court of Munich of 12 December 2018 - M 9 K 18.4553 - and the decision of the defendant of 1 August 2018 - S-III-W/BS-114 FeWo - are revoked.II. The defendant bears the costs of the proceedings in both instances.III. The defendant may avert enforcement by providing security in the amount of the costs to be enforced unless the plaintiff provides security in the same amount beforehand.IV. The appeal is not allowed.groundsI.1 The plaintiff, a legal person under private law with its registered office in Dublin (Ireland), which operates an online platform for booking and renting private accommodation, is contesting a law on the (Bavarian) law on the misappropriation of purposes - Zwecktfremdungsgesetz (ZwEWG) of 10 December 2007 (GVBl. S. 864, BayRS 2330-11-B), last amended by the law of June 19, 2017 (GVBl. S. 182), and the statutes of the defendant on the prohibition of the misappropriation of residential property (ZeS) of December 5, 2017, published on December 11, 2017 (MüABl. S. 494).21 The corresponding legal bases - Art. 3 (1) sentences 1, 3 and 5 ZwEWG, Section 12 (1) sentence 1 half 1, sentence 2 and sentence 4 ZeS - have the following wording:3Art. 3 (1) ZwEWG4
1 The persons authorised in rem, owners, administrators and intermediaries must provide the commune with the information and submit the documents required to monitor compliance with the provisions of this Act. 3 The persons obliged to provide information must also disclose facts that are likely to lead to prosecution for a criminal offence or an administrative offence. [...] 5 sentence 1 also applies to service providers within the meaning of the Telemedia Act.5 § 12 paragraph 1 ZeS61 On the basis of Art. 3 sentence 1 ZwEWG, the persons entitled to dispose in rem, owners, administrators, intermediaries must provide the authority with the information and submit the documents required to monitor compliance with the provisions of the Act and these Statutes [...]. 2 The persons obliged to provide information must also disclose facts that are likely to lead to prosecution for a criminal offence or an administrative offence. [...] 4 sentence 1 also applies to service providers within the meaning of the Telemedia Act.72 After hearing the plaintiff by means of a hearing letter drafted in German, the defendant issued the following verbatim orders by means of the disputed decision of 1 August 2018, file no. S-III-W/BS-114 FeWo:8"1. Please provide us with written information regarding the following sections 1.1 to 1.3 regarding all advertisements that can be found with the search options "Accommodation in Munich" and "Total accommodation" on your Internet portal www.a... .de and which were actually booked for more than eight weeks per calendar year:91.1 The exact address of the accommodation (street and house number).101.2 The name and address of the host or the names and addresses of the hosts.111 .3 The periods in which the accommodation was booked (from 1 January 2017 up to the date of this notice).12 The information shall be structured in such a way that the corresponding host (1.2) and also the booked periods (1.3) can be assigned without doubt to each accommodation (1.1).132 If you do not provide us with the information provided in section 1 in an all-encompassing and comprehensible manner by one month after notification of this decision at the latest, a penalty payment of EUR 300,000.00 will be due. "14 As justification, it was argued, among other things, that with regard to a large part of the advertisements with the search options described in the tenor - an estimated 1,000 apartments - there was a well-founded initial suspicion that the right to misuse the information was being violated. The number of evaluations of the respective accommodation per year alone allows the assumption that it is used for more than eight weeks per year. A misappropriation exists if the residential property is used for accommodation of foreigners for more than a total of eight weeks in a calendar year (§ 4.1 sentence 2 no. 3 ZeS) and commercial use is not permitted under building law, although this can only be clarified "in individual cases". Units used without permission with a residential use of more than 50% and offers of up to eight weeks per year were not queried. The plaintiff is a service provider according to § 2 sentence 1 no. 1, no. 2, § 2a paragraph 1 Telemediengesetz - TMG - and as such is subject to the obligation to provide information. The defendant had no other possibility to obtain the necessary data. The defendant's obligation to secure living space outweighs the profit motive of both individuals and the platform operator in 
the framework of commissions received. The shortage of housing has serious socio-political consequences. Even if the estimated up to 1,000 apartments used for other purposes were not occupied 1:1 by registered housing seekers, this number would relieve the housing market as a whole. The data protection of users, on the other hand, would have to take a back seat. The threat of a fine, number 2, is based on Articles 29, 31 and 36 BayVwZVG. A penalty payment threatened to exceed the statutory limit of EUR 50,000.153 In a written statement dated 10 September 2018, received by the court on 12 September 2018, the plaintiff brought an action.16 The identification number submitted proves that the contested decision reached Ireland only on 14 August 2018 and was not received before 15 August 2018; the action is therefore not time-barred. The defendant has no authority to take the ordered enforcement action; it lacks local jurisdiction and the authority to order enforcement outside the boundaries of its urban area. For that reason alone, the administrative act was null and void. Furthermore, the decision with the threat of a periodic penalty payment to be served pursuant to Article 36.7 BayVwZVG had not been formally served either. Dispatch by registered letter/advice of receipt, even if it had actually been sent, was not an effective form of service. In contrast to what is required under Article 14(1)(1) BayVwZVG, service by post is not permissible in the present case under international law. Ireland has not ratified the European Convention on the service abroad of documents in administrative matters. Nor could the deficiencies in the service of documents be remedied, since the plaintiff had accepted the illegal service with a clear conscience.17 Nevertheless, the Basic Decision was also substantively unlawful. There was already a lack of a legal basis, since Article 3 (1) sentence 5 ZwEWG, § 12 (1) sentence 4 ZeS, at any rate as interpreted by the defendant, violated fundamental rights of the German Basic Law (GG) and the European Charter of Fundamental Rights (GRCh). State legal provisions which obliged enterprises to disclose personal data of third parties contained an unjustified encroachment on the fundamental right to informational self-determination, Article 2.1, Article 1.1 of the Basic Law, and on the freedom of occupation of the enterprise concerned, Article 12.1 of the Basic Law, and Articles 7 and 8 of the GRCh. The version of the underlying provisions was not sector-specific, not precise and not clear in terms of standards. The ruling did not contain a genuine, and in any case not an appropriate, weighing of the conflicting interests. The authority requested a large amount of user data well in advance of a sufficient suspicion of a crime. The decision did not constitute unlawful conduct by the users affected by the inquiry. The fact that the entire accommodation was rented out for more than eight weeks did not constitute illegal behaviour. Rather, all commercial lettings and all rooms for which replacement living space has been created or which can be let for more than eight weeks on another basis with permission are affected. The users had not consented to this. Moreover, the defendant was not dependent on this either, as there were other possibilities, e.g. registration and publication obligations of registration numbers to ensure direct traceability of the providers. Furthermore, the legal basis was not applicable at all, as it had been adopted in violation of the notification obligation under Article 5(1) of Directive 2015/1535/EU. Even if the legal basis could be applied, it did not authorise the defendant to request information from a data subject resident abroad. Bavarian law ends at the border of the Free State. Notwithstanding this, the Basic Decision is null and void, and in any event unlawful, because it requires the plaintiff to act in breach of data protection law. There is no legal basis for the processing ordered by the applicant: Article 6(1)(c) of the Basic Regulation on data protection does not apply, since the applicant is subject only to Irish law, but it follows from Article 6(3) of the Basic Regulation that legal obligations in other Member States are not relevant. Furthermore, Article 3(1), first sentence, Article 3(5) of the ZwEWG and Paragraph 12(1), first sentence, Article 12(4) of the ZeS are not specific within the meaning of Article 6(2) and the second subparagraph of Article 6(3) of the DS Regulation and do not satisfy the requirement of foreseeability. It was not apparent from the legal basis that personal data could also be processed in addition to data relating to housing. Furthermore, there was no reference to the DS-GVO. Furthermore, Article 3.1 sentence 5 of the ZwEWG infringed not only § 7.2 of the Telemedia Act but also 
also Section 14 (2) TMG. Neither does the defendant belong to the group of competent users nor is the purpose of the information covered by Section 14 (2) German Telemedia Act. The purpose of criminal prosecution would not exist in the case of purely administrative offences. Moreover, § 14.2 and § 15.5 sentence 4 of the German Telemedia Act were conclusive federal law. The country of origin principle, Section 3 (2) German Telemedia Act, had also not been observed. The defendant could not order data flows from abroad and the plaintiff could not be subjected to stricter requirements than in the country of origin. To the extent that the legal basis used by the defendant goes beyond the law applicable in the state in which the company has its registered office, this provision is not applicable; it is modified by overriding federal law, Section 3 (2) of the German Telemedia Act, or is displaced in an interpretation that conforms to the Directive or is broken under Article 31 of the Basic Law. § Section 3 (5) TMG does not intervene. The provision, when interpreted in conformity with the Directive, only covers existence-threatening or serious and grave impairments of the stated protection objectives. If a member state wishes to make use of the exception in an individual case, the notification procedure provided for in Section 3 (5) sentence 2 of the German Telemedia Act must also be followed. Finally, the enforcement measures were also substantively unlawful.184 In its judgment of 12 December 2018, the Administrative Court dismissed the action as unfounded. A search with the so-called identification number of the post office had revealed that the consignment of the contested decision had been recorded in Ireland (only) on 14 August 2018. The claim of 12 September 2018 was therefore admissible and not time-barred. Both the information order in no. 1 of the decision and the threat of a periodic penalty payment in no. 2 were lawful and did not violate the plaintiff's rights under § 113.1 sentence 1 VwGO.19 The information order was formally lawful, the defendant was responsible for issuing it and the proceedings were conducted properly. With the order relating to "accommodation in Munich", a connecting factor establishing competence had been established, namely a connection to individual residential units located in the city area and thus to immovable property, so that the corresponding brokerage activity could also be subject to orders by the defendant. The same follows from Article 3 (1) sentence 5 of the ZwEWG, Section 3 (5) no. 1 of the German Telemedia Act, according to which service providers and platform operators are subject to restrictions under domestic law irrespective of their registered office, and Section 3 (2) sentence 2, (5) of the German Telemedia Act.20 The information order is also substantively lawful. The legal basis, Article 3.1 sentence 1, sentence 3, sentence 5 of the ZwEWG, was effective and constitutional. The use of indefinite legal terms did not violate the requirement of certainty resulting from Article 20.3 of the Basic Law. Nor did Article 2.1 of the Basic Law preclude it. Moreover, it was not the plaintiff's responsibility to complain about possible encroachments on the basic rights of the host as a user of the platform instead of possible affected parties - in the present case: the host as a user of the platform. If one attributed a tendency to regulate the profession to the legal admission of a claim to information, the freedom to exercise the profession was in any case relatively restricted by this, Article 12.1 sentence 2 of the Basic Law. The individual parameters of the information order ensured that information was not obtained in vague terms, but only on the basis of sufficient initial suspicion. An obligation to register was not equally suitable for combating the misappropriation of housing. Art. 3 para. 1 sentence 1, sentence 3, sentence 5 of the ZwEWG had not been issued in breach of the Notification Directive (Art. 5 para. 1 in conjunction with Art. 1 para. 1 lit. b and e of Directive 2015/1535/EU). Article 3(1), first sentence, third sentence, fifth sentence of the ZwEWG already did not constitute "regulatory services" within the meaning of Article 1(1)(b) and (e) of the Directive. The obligation to provide user data on request has at best only an indirect or ancillary effect on the service, in particular it does not directly regulate the operation of the service and does not concern access to the services, nor does it contain provisions on the provider or the recipient of services. Art. 3(1) sentence 1, sentence 3, sentence 5 of the ZwEWG also did not infringe the provisions of the Telemedia Act adopted in implementation of Directive 2000/31/EC (E-Commerce Directive). The reference in Article 3 (1) sentence 5 of the Introductory Act satisfies the requirements of Section 12 (2) of the Telemedia Act. If the basis for authorisation in Article 3 (1) sentence 1, sentence 3 of the Introductory Act were nevertheless to be regarded as a restriction of the freedom to provide services in the case of telemedia - which is not the case, because neither their offer nor their provision is restricted thereby - this would be possible despite the applicant's seat in Ireland pursuant to Section 3 (2) sentence 2, (5) of the German Telemedia Act, because in the present case the exception to the so-called "freedom to provide services" laid down in Section 3 (5) of the German Telemedia Act applies.