LfDI (Bremen) - 08/2022: Difference between revisions

Revision as of 11:37, 23 August 2022

LfDI - DPA of Bremen causes stop of inadmissible publications of personal insolvency data

Authority:	LfDI (Bremen)
Jurisdiction:	Germany
Relevant Law:	Article 6 GDPR
Type:	Investigation
Outcome:	Other Outcome
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	DPA of Bremen causes stop of inadmissible publications of personal insolvency data
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	German
Original Source:	Landesbeauftragter für Datenschutz Bremen (in DE)
Initial Contributor:	Marieta Gencheva

The DPA of Bremen held that the publication of insolvency debtors' data on law firms' websites lacked a proper legal basis under Article 6 GDPR.

English Summary

Facts

In connection with a complaint procedure, the DPA of Bremen (LfDI Bremen) had become aware that the data of insolvency debtors were publicly accessible without any preconditions on websites of law firms located in Bremen.

Holding

The DPA of Bremen investigated the publication of this data in the creditor information systems of the relevant insolvency law firms. It determined that the publication of this data violated Article 6 GDPR due to a lack of proper legal basis.

The DPA of Bremen confirmed that the insolvency law firms are required by law to set up creditor information systems containing the data of insolvency debtors. However, this must be done in compliance with data protection laws.

As result of the DPA's findings, the software used for the creditor information systems was adapted. The data of insolvency debtors in these publicly accessible creditor information systems can now only be viewed if their first and last names, the insolvency court and the court file number are entered in the search field.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

P R E S S E R I T S E L I N G LfDI control brings about a stop to inadmissible publications of personal insolvency data At the urging of the Bremen State Commissioner for Data Protection and Freedom of Information (LfDI), law firms entrusted with insolvency administration have worked towards the search mask in the digital creditor information system they use being reprogrammed in compliance with data protection.

In connection with a complaints procedure, the LfDI became aware that the data of the insolvency debtors was publicly accessible on the websites of the law firms without any prerequisites. The LfDI then checked the publication of this data in the creditor information systems of the most popular insolvency law firms operating in Germany and based in Bremen. In doing so, she determined that the publications violated data protection due to the lack of a sufficient legal basis. The affected law firms were mostly cooperative and successfully influenced the software provider. The adapted software is now also used nationwide by non-verified law firms.

From now on, the data of the insolvency debtors can only be requested in the publicly accessible creditor information systems of those insolvency law firms that use the software of the provider concerned if their first and last name, the insolvency court and the court file number are entered in the search mask.

The Bremen State Commissioner for Data Protection and Freedom of Information, Dr. Sommer, is satisfied that the technical solution achieved will prevent the illegal publications that have been identified in the future: "Once again it has been shown that in a digitized world data protection through technology is the be-all and end-all. Insolvency law firms are fundamentally legally obliged to have digital information systems ready that contain data from insolvency debtors. This must of course be done in accordance with data protection regulations. In addition to the limited findability of the personal data, this also means that the statutory deletion periods are observed. We will continue to monitor this in the future, in particular because the publication of this data is for those affected significant economic stigma."

Contact/enquiries:

dr Imke Sommer, telephone 0421 361-2010

@@ Line 59: / Line 59: @@
 }}
-The DPA of Bremen held, that the publication of data of the insolvency debtors on the websites of the law firms is a violation of data protection due to the lack of a sufficient legal basis.
+The DPA of Bremen held that the publication of insolvency debtors' data on law firms' websites lacked a proper legal basis under [[Article 6 GDPR]].
 == English Summary ==
 === Facts ===
-In connection with a complaint procedure, the DPA of Bremen (LfDI Bremen) had become aware, that the data of the insolvency debtors were publicly accessible without any preconditions on the websites of the law firms, located in Bremen.
+In connection with a complaint procedure, the DPA of Bremen (LfDI Bremen) had become aware that the data of insolvency debtors were publicly accessible without any preconditions on websites of law firms located in Bremen.
 === Holding ===
-The DPA of Bremen had reviewed the publication of this data in the creditor information systems of the insolvency law firms.It has determined that the publications were in violation of data protection due to the lack of a sufficient legal basis.
+The DPA of Bremen investigated the publication of this data in the creditor information systems of the relevant insolvency law firms. It determined that the publication of this data violated [[Article 6 GDPR]] due to a lack of proper legal basis.
-The DPA of Bremen confirmed, that the insolvency law firms are required by law to provide digital information systems containing the data of insolvency debtors, but this must be done only in compliance with data protection laws.
+The DPA of Bremen confirmed that the insolvency law firms are required by law to set up creditor information systems containing the data of insolvency debtors. However, this must be done in compliance with data protection laws.
-As result, the software was adapted and now also being used nationwide by law firms that were not audited. The data of insolvency debtors in the publicly accessible creditor information systems of those insolvency law firms that use the software of the provider in question, can only be requested if their first and last names, the insolvency court and the court file number are entered in the search mask.
+As result of the DPA's findings, the software used for the creditor information systems was adapted. The data of insolvency debtors in these publicly accessible creditor information systems can now only be viewed if their first and last names, the insolvency court and the court file number are entered in the search field.
 == Comment ==
-No information or details about the complaint
 == Further Resources ==
 ''Share blogs or news articles here!''