OLG Schleswig - 17 U 5/22: Difference between revisions
(Excellent summary! Just did a little bit of rephrasing and rearranging of the facts and structuring of the holding) |
No edit summary |
||
| Line 73: | Line 73: | ||
The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job. | The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job. | ||
In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate. | In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate. | ||
The data subject, consequently, filed a lawsuit against the controller before the Regional Court Kiel (Landgericht Kiel - LG Kiel) requesting the deletion of the record and the correction of his credit score in a way that the insolvency proceedings are no longer taken into account as a factor in the calculation. The LG Kiel dismissed the claim holding that the controller's and its customer's legitimate interest in knowing about the insolvency proceedings outweighs the interests of the data subject. The data subject then appealed this decision before the Higher Regional Court of Schleswig-Holstein (Oberlandesgericht Schleswig-Holstein - OLG Schleswig-Holstein). | The data subject, consequently, filed a lawsuit against the controller before the Regional Court Kiel (Landgericht Kiel - LG Kiel) requesting the deletion of the record and the correction of his credit score in a way that the insolvency proceedings are no longer taken into account as a factor in the calculation. The LG Kiel dismissed the claim holding that the controller's and its customer's legitimate interest in knowing about the insolvency proceedings outweighs the interests of the data subject. The data subject then appealed this decision before the Higher Regional Court of Schleswig-Holstein (Oberlandesgericht Schleswig-Holstein - OLG Schleswig-Holstein). | ||
| Line 80: | Line 80: | ||
The OLG Schleswig-Holstein set aside the judgement of the LG Kiel and upheld the claim. It found that the data subject was entitled request the erasure of the record under [[Article 17 GDPR#1d|Article 17(1)(d) GPDR]] because the processing was unlawful. | The OLG Schleswig-Holstein set aside the judgement of the LG Kiel and upheld the claim. It found that the data subject was entitled request the erasure of the record under [[Article 17 GDPR#1d|Article 17(1)(d) GPDR]] because the processing was unlawful. | ||
First, the court determined that neither Article 6(1)(a) GDPR nor Article 6(1)(e) GDPR provide a legal basis for the processing because the data subject did not consent to the processing and the activities of the controller cannot be considered as necessary for the performance of a task carried out in the public interest, | First, the court determined that neither [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] nor [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] provide a legal basis for the processing because the data subject did not consent to the processing and the activities of the controller cannot be considered as necessary for the performance of a task carried out in the public interest. Regarding [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], the court referred to its previous decision ([[OLG Schleswig - 17 U 15/21]]) where it had already established that [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] is not a legal basis for the activities of a credit rating agency. | ||
Second, the court disagreed with the view of the LG Kiel that storing the information about the insolvency proceeds even after the six months period of § 3(1) InsoBekV had elapsed was lawful under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Here the court also referred to its previous decision [[OLG Schleswig - 17 U 15/21]] in which it found that a credit rating agency's interest in storing the information longer than the six months period cannot be legitimate, because this would lead to a contradiction with the objective of § 3(1) InsoBekV and modern insolvency law to enable the former insolvent debtor to start fresh after the termination of the insolvency proceedings. However, this time the court explicitly stated that it leaves the question unanswered whether the interest of a credit rating agency is illegitimate only because of this contradiction. The court took another approach this time and weighed the interests of the controller against the interests of the data subject. In this balancing of interests, it found that the controller only had a legitimate interest in storing the information about the insolvency proceeding for the period that the information was publicly accessible in the insolvency announcement portal "www.insolvenzbekanntmachungen.de". After this period, the interests of the data subject overrode the economic interest of the controller in having a comprehensive database, because the storing of the information about the insolvency proceedings did not only interfere with the data subject's right to informational self-determination and data protection, but also with his basic rights to self-expression, contractual freedom and to occupation. The latter because | |||
== Comment == | == Comment == | ||
== Further Resources == | == Further Resources == | ||
Revision as of 11:58, 22 June 2022
| OLG Schleswig - 17 U 5/22 | |
|---|---|
 | |
| Court: | OLG Schleswig (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 17(1)(c) GDPR Article 17(1)(d) GDPR § 3 InsoBekVO |
| Decided: | 03.06.2022 |
| Published: | |
| Parties: | SCHUFA Holding AG |
| National Case Number/Name: | 17 U 5/22 |
| European Case Law Identifier: | ECLI:DE:OLGSH:2022:0603.17U5.22.00 |
| Appeal from: | LG Kiel (Germany) 10 O 127/21 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | REWIS (in German) |
| Initial Contributor: | n/a |
The Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein) ruled that under current German law a credit rating agency may only lawfully process personal information from insolvency proceedings no later than six months after their termination.
English Summary
Facts
The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job.
In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate.
The data subject, consequently, filed a lawsuit against the controller before the Regional Court Kiel (Landgericht Kiel - LG Kiel) requesting the deletion of the record and the correction of his credit score in a way that the insolvency proceedings are no longer taken into account as a factor in the calculation. The LG Kiel dismissed the claim holding that the controller's and its customer's legitimate interest in knowing about the insolvency proceedings outweighs the interests of the data subject. The data subject then appealed this decision before the Higher Regional Court of Schleswig-Holstein (Oberlandesgericht Schleswig-Holstein - OLG Schleswig-Holstein).
Holding
The OLG Schleswig-Holstein set aside the judgement of the LG Kiel and upheld the claim. It found that the data subject was entitled request the erasure of the record under Article 17(1)(d) GPDR because the processing was unlawful.
First, the court determined that neither Article 6(1)(a) GDPR nor Article 6(1)(e) GDPR provide a legal basis for the processing because the data subject did not consent to the processing and the activities of the controller cannot be considered as necessary for the performance of a task carried out in the public interest. Regarding Article 6(1)(e) GDPR, the court referred to its previous decision (OLG Schleswig - 17 U 15/21) where it had already established that Article 6(1)(e) GDPR is not a legal basis for the activities of a credit rating agency.
Second, the court disagreed with the view of the LG Kiel that storing the information about the insolvency proceeds even after the six months period of § 3(1) InsoBekV had elapsed was lawful under Article 6(1)(f) GDPR. Here the court also referred to its previous decision OLG Schleswig - 17 U 15/21 in which it found that a credit rating agency's interest in storing the information longer than the six months period cannot be legitimate, because this would lead to a contradiction with the objective of § 3(1) InsoBekV and modern insolvency law to enable the former insolvent debtor to start fresh after the termination of the insolvency proceedings. However, this time the court explicitly stated that it leaves the question unanswered whether the interest of a credit rating agency is illegitimate only because of this contradiction. The court took another approach this time and weighed the interests of the controller against the interests of the data subject. In this balancing of interests, it found that the controller only had a legitimate interest in storing the information about the insolvency proceeding for the period that the information was publicly accessible in the insolvency announcement portal "www.insolvenzbekanntmachungen.de". After this period, the interests of the data subject overrode the economic interest of the controller in having a comprehensive database, because the storing of the information about the insolvency proceedings did not only interfere with the data subject's right to informational self-determination and data protection, but also with his basic rights to self-expression, contractual freedom and to occupation. The latter because
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
36,399 | Total areas of law 1,358 | Employment Law 680 | banking law 1,941 | building rights 158 | right of inheritance 202 | European law 520 | family law 3,664 | commercial and corporate law 227 | bankruptcy law 1,610 | IT and media law 933 | Cost and fee law 1,895 | medical law 388 | Tenancy and home ownership law 2,733 | social law 2,756 | state and constitutional law 755 | tax law 1,588 | criminal law 5,531 | environmental law 965 | traffic law 514 | insurance law 23,446 | administrative law 257 | Competition and Intellectual Property Law 2.144 | Civil and Civil Procedure Law 452 | Other
