VGH München - 11 ZB 22.895: Difference between revisions
No edit summary |
No edit summary |
||
(8 intermediate revisions by 4 users not shown) | |||
Line 27: | Line 27: | ||
|GDPR_Article_1=Article 17 GDPR | |GDPR_Article_1=Article 17 GDPR | ||
|GDPR_Article_Link_1=Article 17 GDPR | |GDPR_Article_Link_1=Article 17 GDPR | ||
|GDPR_Article_2= | |GDPR_Article_2=Article 6 GDPR | ||
|GDPR_Article_Link_2= | |GDPR_Article_Link_2=Article 6 GDPR | ||
|GDPR_Article_3= | |GDPR_Article_3=Article 5 GDPR | ||
|GDPR_Article_Link_3= | |GDPR_Article_Link_3=Article 5 GDPR | ||
|EU_Law_Name_1= | |EU_Law_Name_1= | ||
Line 49: | Line 49: | ||
|Party_Link_2= | |Party_Link_2= | ||
|Appeal_From_Body= | |Appeal_From_Body= | ||
|Appeal_From_Case_Number_Name= | |Appeal_From_Case_Number_Name= | ||
|Appeal_From_Status= | |Appeal_From_Status= | ||
Line 67: | Line 67: | ||
=== Facts === | === Facts === | ||
The plaintiff owns a | The plaintiff owns a secondhand car dealership. One of the plaintiff's vehicles, driven by an unknown person, exceeded the permitted speed of 50 km/h. The police administration office sent the plaintiff a witness questionnaire and asked for the personal details of the responsible driver. The plaintiff stated that the person in the picture was not recognizable to him. The vehicle in question had been for sale and he had given it to persons unknown to him for test drives. He had always asked for a valid driver's license, which he only took a look at to make sure the person is allowed to drive. For reasons of protection of personal data, he did not store the data. | ||
The fine proceedings were then discontinued, but the authorities wanted to impose a | The fine proceedings were then discontinued, but the authorities wanted to impose a requirement to keep a record of people driving cars that are registered in his name on the plaintiff. This can be imposed as an obligation under Article 31a StVZO - Road Traffic Licensing Regulations, if in the past a person who has more cars registered in his name, has failed to identify the driver of one of his cars. | ||
In the proceedings that followed, the plaintiff claimed that even if he did store the data for the period of the vehicle being driven by the other person, he would erase it pursuant to [[Article 17 GDPR]] after the drive. He argued that if it was not intended to buy the car, there was no actual legal basis under the GDPR to store such data. | |||
=== Holding === | === Holding === | ||
The | The Higher Administrative Court of Bavaria (VGH München) held that the plaintiff was required to document test drives and that this obligation was not contrary to [[Article 6 GDPR|Article 6(1) GDPR]]. Pursuant to [[Article 6 GDPR|Article 6(1)(f) GDPR]], a controller may use the legal basis of legitimate interest even if those legitimate interests are pursued by a third party. Hence, the applicable legal basis for the plaintiff (the car dealer) was [[Article 6 GDPR|Article 6(1)(f) GDPR]] as the police, a third party, had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which include the prosecution of administrative offenses. This legitimate interest of the police outweighs the interests of the drivers. | ||
This processing of personal data is also not contrary to the purpose limitation principle under [[Article 5 GDPR|Article 5(1)(b) GDPR]] as the purpose of the data storage in connection with driving includes the processing of administrative or judicial sanctions. After a compatibility check pursuant to [[Article 6 GDPR|Article 6(4) GDPR]], even a change of purpose would be permissible in this context. | |||
== Comment == | == Comment == | ||
Interestingly, the court did not mention [[Article 6 GDPR|Article 6(1)(c) GDPR]] or [[Article 6 GDPR|Article 6(1)(e) GDPR]] as possible legal bases for processing. | |||
== Further Resources == | == Further Resources == | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' |
Latest revision as of 13:20, 31 August 2022
VGH München - 11 ZB 22.895 | |
---|---|
Court: | VGH München (Germany) |
Jurisdiction: | Germany |
Relevant Law: | Article 17 GDPR Article 6 GDPR Article 5 GDPR Straßenverkehrs-Zulassungs-Ordnung (StVZO) |
Decided: | 22.07.2022 |
Published: | |
Parties: | |
National Case Number/Name: | 11 ZB 22.895 |
European Case Law Identifier: | |
Appeal from: | |
Appeal to: | |
Original Language(s): | German |
Original Source: | OpenJur (in German) |
Initial Contributor: | Sara Horvat |
The Higher Administrative Court of Bavaria (VGH München) held that a car dealer's obligation to document the personal data of unknown test drivers is not contrary to Article 6(1) GDPR as the legitimate interests of the police outweigh the interests of the drivers.
English Summary
Facts
The plaintiff owns a secondhand car dealership. One of the plaintiff's vehicles, driven by an unknown person, exceeded the permitted speed of 50 km/h. The police administration office sent the plaintiff a witness questionnaire and asked for the personal details of the responsible driver. The plaintiff stated that the person in the picture was not recognizable to him. The vehicle in question had been for sale and he had given it to persons unknown to him for test drives. He had always asked for a valid driver's license, which he only took a look at to make sure the person is allowed to drive. For reasons of protection of personal data, he did not store the data.
The fine proceedings were then discontinued, but the authorities wanted to impose a requirement to keep a record of people driving cars that are registered in his name on the plaintiff. This can be imposed as an obligation under Article 31a StVZO - Road Traffic Licensing Regulations, if in the past a person who has more cars registered in his name, has failed to identify the driver of one of his cars.
In the proceedings that followed, the plaintiff claimed that even if he did store the data for the period of the vehicle being driven by the other person, he would erase it pursuant to Article 17 GDPR after the drive. He argued that if it was not intended to buy the car, there was no actual legal basis under the GDPR to store such data.
Holding
The Higher Administrative Court of Bavaria (VGH München) held that the plaintiff was required to document test drives and that this obligation was not contrary to Article 6(1) GDPR. Pursuant to Article 6(1)(f) GDPR, a controller may use the legal basis of legitimate interest even if those legitimate interests are pursued by a third party. Hence, the applicable legal basis for the plaintiff (the car dealer) was Article 6(1)(f) GDPR as the police, a third party, had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which include the prosecution of administrative offenses. This legitimate interest of the police outweighs the interests of the drivers.
This processing of personal data is also not contrary to the purpose limitation principle under Article 5(1)(b) GDPR as the purpose of the data storage in connection with driving includes the processing of administrative or judicial sanctions. After a compatibility check pursuant to Article 6(4) GDPR, even a change of purpose would be permissible in this context.
Comment
Interestingly, the court did not mention Article 6(1)(c) GDPR or Article 6(1)(e) GDPR as possible legal bases for processing.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Bavarian VGH, decision of July 22nd, 2022 - 11 ZB 22.895 reference openJur 2022, 14921 Rkr: tenor I. The application for leave to appeal is denied. II. The plaintiff bears the costs of the admission procedure. III. The amount in dispute for the approval procedure is set at EUR 4,800. reasons I The plaintiff objects to the obligation to keep a logbook. On April 18, 2021 - a Sunday - the vehicle with the registration number RO-... that was registered to the plaintiff at the time exceeded the permissible speed of 50 km/h within built-up areas by 44 km/h. In a letter dated April 29, 2021, the police administration office sent the plaintiff a witness questionnaire and asked for the personal details and address of the responsible driver to be communicated. The plaintiff then stated on May 6, 2021 that he had not driven and that the person in the picture was not recognizable to him. He registered the vehicle the same day. In response to a request for an investigation from the police administration office on May 10, 2021, police inspection B. reported in a letter dated June 11, 2021 that the determination of the responsible driver had remained unsuccessful. The owner's address had been visited several times. Apparently, the plaintiff's partner was not the responsible driver. The plaintiff also stated that he did not know the person in the picture and was extremely uncooperative and aggressive. The surrounding residents had been questioned, but could not have provided any relevant information. The fine proceedings were then discontinued. With a letter dated June 21, 2021, the police administration office sent the process to the R district office. At the hearing on the intended issue of the logbook, the plaintiff stated in a letter dated October 25, 2021 that he ran a car dealership and a car workshop. The above-mentioned vehicle was for sale and was often test driven by people he knew and people he didn't know. To do this, it was sufficient for him to present a valid driver's license; For data protection reasons, he is not permitted to save personal data without consent. Since he did not know the person, he could not provide any information about the driver of the vehicle. But he has learned something new and will meticulously save the data in the future, of course with the consent of the person concerned. With a decision dated November 5, 2021, the district office obliged the plaintiff to keep a logbook for the vehicle currently registered to the plaintiff with the registration number RO-... and any replacement vehicle. The driver of the (deregistered) vehicle with the registration number RO-... could not be found out despite extensive police investigations. The traffic violation committed is so serious that it justifies the imposition of a logbook for the prescribed period. Since the vehicle in question had been taken out of service, the above-mentioned vehicle was designated as the replacement vehicle. On December 6, 2021, the plaintiff filed an action for annulment, which the Munich Administrative Court dismissed in a judgment dated January 21, 2022. The factual prerequisites for the arrangement of a logbook are present. It was impossible to identify the driver of the vehicle. The police took all reasonable and appropriate investigative measures, in particular sent the witness questionnaire to the plaintiff within two weeks. It is not decisive whether the plaintiff was aware of the person responsible for the driver and whether he was partly to blame for the impossibility of identifying the driver. Incidentally, it is probably a question of a purely protective claim if the plaintiff argues that the data of the vehicle driver is not recorded during test drives, since this contradicts his own interests and life experience. The exercise of discretion is not objectionable and in particular satisfies the principle of proportionality. With his application for permission to appeal, which the defendant objects to, the plaintiff asserts serious doubts about the correctness of the judgment, particular factual and legal difficulties and the fundamental importance of the case. For further details, reference is made to the court files of both instances and to the submitted official files. II. The application for admission of the appeal is unsuccessful because the asserted reasons for admission are not available or not sufficiently explained (§ 124 Para. 4 Clause 4, § 124a Para. 5 Clause 2 VwGO). 1. From the arguments of the plaintiff, to which the examination of the Administrative Court is limited (§ 124a Section 4 Clause 4, Section 5 Clause 2 VwGO), there are no serious doubts as to the correctness of the first instance decision (§ 124 Section 2 No. 1 VwGO), since he has neither questioned a fundamental legal principle of the judgment under appeal nor a significant finding of fact with conclusive counter-arguments (cf. BVerfG, B.v. 9.6.2016 - 1 BvR 2453/12 - NVwZ 2016, 1243 para. 16; B.v. 18.6.2019 - 1 BvR 587/17 - BVerfGE 151, 173 = para. 32 with further references). a) According to Section 31a (1) sentence 1 of the Road Traffic Licensing Regulations (StVZO) of April 26, 2012 (Federal Law Gazette I p. 679), last amended by law on July 12, 2021 (Federal Law Gazette I p. 3091). the competent authority under state law order a vehicle owner to keep a logbook for one or more vehicles registered or to be registered in his name if it was not possible to identify a vehicle driver after violating traffic regulations. You can designate one or more replacement vehicles for this purpose (§ 31a Para. 1 Sentence 2 StVZO). If the factual requirements of § 31a Para. 1 StVZO are met, the issuing of the order and the determination of the duration are at the dutiful discretion of the competent authority (BVerwG, U.v. 28.5.2015 - 3 C 13.14 - BVerwGE 152, 180 marginal number 16) and must therefore prove to be proportionate. b) Based on this, the grounds for the application do not seriously call into question the administrative court's assumption that it was impossible to identify the driver of the vehicle. It is impossible to identify the driver of the vehicle within the meaning of Section 31a (1) sentence 1 StVZO if the authority has taken all appropriate and reasonable measures to identify him based on the circumstances of the individual case. The type and extent of the investigations depend in particular on the type of traffic violation in question and the willingness of the vehicle owner to cooperate in identifying the driver. The authority has to take appropriate and rational use of the means at its disposal, according to its due discretion, the measures that experience has shown to lead to success in similar cases (cf. BVerwG, U.v. 17.12.1982 - 7 C 3.80 - VRS 64, 466 = juris para. para. 7). If the vehicle owner refuses to cooperate in identifying the driver of the vehicle, further investigations are generally unreasonable (BVerwG, U.v. 17.12.1982 a.a.O.). Rather, a vehicle owner who, neglecting his supervisory powers, cannot or does not want to show who was driving his vehicle at a certain point in time in connection with a traffic offense may, in principle, be required to keep a logbook to monitor vehicle use in a verifiable manner (Federal Administrative Court, B.v. 23.6 .1989 - 7 B 90.89 - NJW 1989, 2704 = juris para. 8; BayVGH, B.v. 6.5.2010 - 11 ZB 09.2947 - SVR 2010, 347 = juris para. 8). However, even in such cases, the prosecuting authority must pursue obvious approaches to driver identification that can be carried out with little effort and document the result of their efforts (cf. on all this BayVGH, U.v. 18.2.2016 - 11 BV 15.1164 - DAR 2016, 286 = juris para. 17) . These requirements are satisfied here. It was not substantiated that further investigations would have been reasonable and promising, but it is also not apparent. The plaintiff's objection that the investigations took place too late is unfounded. In principle, it is part of a reasonable investigative effort by the prosecuting authority to notify the vehicle owner immediately, i.e. regularly within two weeks, of the offense committed with his vehicle (cf. duration in Hentschel/König/Dauer, Road Traffic Law, 46th ed. 2021, § 31a StVZO marginal 27; BVerwG, U.v. 13.10.1978 - VII C 77.74 - NJW 1979, 1054 = juris marginal 19). This deadline, which is based on the empirical fact that a person will usually be able to remember or at least reconstruct events in their personal life from the last 14 days (cf. Dauer, loc 2798/93 - NJW 1995, 3335 = juris para. 16; BayVGH, U.v. 18.2.2016, loc. cit. para. 18), with the dispatch of the hearing letter of April 29, 2021, as the administrative court correctly assumed, has evidently been complied with. Apart from that, any delay according to the plaintiff's statement would not be the reason for the failure to investigate. After that, the plaintiff made the vehicle in question available to an unknown customer for a test drive, but did not take any notes on his identity because the purchase did not materialize. It can therefore be assumed that an earlier hearing would not have produced a different result, since the lack of success is not related to the plaintiff's fading memory (cf. Dauer, loc 07.1802 - juris marginal note 12). Furthermore, a delay would also be harmless because test drives can be expected to be documented at a car dealership. In the event that a vehicle is handed over to an unknown person or to a person who is known to him, but with whom he cannot reliably contact him, the owner is generally obliged to determine the exact identity of the driver of the vehicle in advance and to take notes . Because a reasonable owner is already in his own interest concerned with being able to demonstrate to a third party at all and even for a certain period of time after the vehicle has been handed over for use, who exercised actual power over this thing and within what period of time in order to then protect his interests can if the public authority or private third parties come to him because of illegal actions that were committed during the vehicle rental (cf. BayVGH, B.v. 6.5.2010 - 11 ZB 09.2947 - SVR 2010, 347 = juris para. 8; U.v. 18.2. 2016, loc.cit. para. 23). This is especially true for trips within the scope of a commercial operation. Irrespective of the scope of statutory bookkeeping obligations, it is appropriate behavior on the part of an economic operator to document journeys made with a company car over the long term (cf. Dauer, loc. 16; OVG NW, U.v. 31.3.1995 - 25 A 2798/93 - NJW 1995, 3335 = juris marginal note 17; B.v. 10.9.2019 - 8 B 774/19 - VRS 137, 12 = juris marginal note 5; OVG SH, B.v. 26.3.2012 - 2 LA 21/12 - juris note 8 f.; SächsOVG, B.v. 10.1.2020 - 6 B 297/19 - VerkMitt 2020, No. 36 = juris note 3; NdsOVG, B.v. 11.7.2012 - 12 LA 169/11 - ZfSch 2012, 536 = juris para. 6 on car rental). In this context, the plaintiff unsuccessfully asserted the right to erasure or the corresponding obligation to erasure under Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons during processing personal data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation - GDPR; OJ L 119 of May 4th, 2016, p. 1). According to the case law of the Senate, to which the defendant rightly pointed out, - regardless of the opening of the material scope of application of the GDPR - if the factual requirements of § 31a StVZO are met, the personal data of the responsible driver must be passed on to the police pursuant to Art 6 paragraph 1 subparagraph. 1 letter f GDPR to protect the legitimate interests of the police administration office, a third party within the meaning of Art. 4 No. 10 GDPR, permissible when weighed against the interests of the vehicle driver. Authorities have a legitimate interest in fulfilling the tasks incumbent on them in the public interest, which include the prosecution of administrative offences. The power of transmission is also compatible with the principle of earmarking (Art. 5 Para. 1 Letter b GDPR), since the purpose of data storage in connection with driving the vehicle also includes the processing of official or judicial penalties. After a compatibility check in accordance with Art. 6 Para. 4 GDPR, a change of purpose would even be permissible (cf. (cf. BayVGH, B.v. 9.3.2020 - 11 ZB 19.991 - juris para. 20; cf. also OVG Hamburg, B.v. 1.12.2020 - 4 Bs 84/20 - DAR 2021, 581 = juris marginal number 19; on the enforcement of legal claims as a legitimate interest, see Heberlein in Ehmann/Selmayr, GDPR, 2nd edition 2018, Article 6 marginal number 26). of the data by the holder, which also constitutes processing (Art. 4 No. 2 GDPR), nothing else applies.If the application for approval of the appeal raises Art the data would have to be deleted for the reasons given in paragraph 1. Should the presentation aim to ensure that after the test drive has been completed, they would no longer be necessary for the purposes for which they were collected within the meaning of Article 17 paragraph 1 letter a GDPR , he would assume that the purpose of the collection was too narrow because, as already mentioned, this also includes the processing of on administrative or judicial penalties. Furthermore, the justification for further storage can also result from a permissible change of purpose (cf. Leutheusser-Schnarrenberger in Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2nd edition 2020, Art. 17 DSGVO marginal number 24; Kamann/Braun in Ehmann/Selmayr, GDPR, Art. 17 para. 22). There is therefore no need to discuss whether there is an exception in accordance with Art. 17 (3) GDPR. The plaintiff's objection that he was not able or not allowed to name the driver at all is therefore irrelevant from the outset. Apart from that, the fulfillment of the factual requirements of § 31a StVZO does not depend on whether the owner is at fault for the impossibility of identifying the driver of the vehicle. Because the obligation to keep a logbook has a preventive and not a punitive function. It represents a measure to avert danger serving the safety and order of road traffic, with which it is intended to ensure that future determinations of a vehicle driver after an infringement of traffic regulations are possible without difficulty (cf. OVG NW, B.v. 11.11.2013 - 8 B 1129/13 - VRS 125, 243 = juris para. 12; BayVGH, B.v. 3.5.2019 - 11 ZB 19.213 - juris para. 17). c) The administrative court's assumption that the contested decision does not suffer from any error of discretion (§ 114 sentence 1 VwGO) and in particular is not disproportionate is also not seriously doubtful. The objections to this are unfounded. If the plaintiff complains that the reasons given in the notice relate primarily to the driver of the vehicle, this does not demonstrate any error of discretion. The order to keep a logbook is a measure to avert dangers to the safety and order of road traffic, which is intended to ensure that in future it will be possible without difficulty to identify a vehicle driver who has violated traffic regulations (cf. BVerwG , B.v. 3.2.1989 - 7 B 18.89 - NJW 1989, 1624 = juris marginal note 4; duration, loc.cit. marginal 11). The district office was guided by this when it stated that the driver's log should ensure that the driver could be held responsible in the future. Also unsuccessful, the application for approval of the appeal misses specific considerations as to why the obligation relates to a replacement vehicle after it was a "sale vehicle". It was obvious and did not require any further justification that the endangerment of the safety and order of road traffic, which the logbook edition wants to counteract, did not disappear with the deregistration of the vehicle with which the unexplainable traffic offense was committed (cf. NdsOVG, B.v. April 30, 2015 - 12 LA 156/14 - ZfSch 2015, 415 = juris para. 9). The same applies if the plaintiff sells the vehicle with the registration number RO-..., for which the obligation to keep a logbook was ordered, as part of his car dealership and acquires other vehicles for resale. This is all the more true here as the plaintiff has stated that in the future the personal details of the drivers will only be recorded with their consent, i.e. that they will continue to not fully comply with their supervisory duties. Finally, the plaintiff wrongly thinks that within the scope of the discretionary decision it should have been taken into account in his favor that he leaves the vehicle for which the logbook order was made to third parties as part of his motor vehicle business. As has been shown, this does not exempt him from his duty of supervision. Rather, this makes the documentation of the journeys appear all the more appropriate and the fact that the vehicle in question is used by a large number of different people underlines the need for the arrangement of a logbook (cf. also OVG Hamburg, B.v. 1.12.2020 - 4 Bs 84/20 - DAR 2021, 581 = juris para. 20). 2. Insofar as the plaintiff puts particular factual and legal difficulties (§ 124 Para. 2 No. 2 VwGO) and a fundamental importance (§ 124 Para. 2 No. 3 VwGO) into the room, their requirements are not set out and are based on the Neither before. 3. As the unsuccessful appellant, the plaintiff has to bear the costs of the proceedings (Section 154 (2) VwGO). 4. The determination of the amount in dispute is based on Section 47 Paragraph 1 Clause 1, Paragraph 3, Section 52 Paragraph 1 GKG in conjunction with the recommendation in No. 46.11 of the catalog of the amount in dispute for administrative jurisdiction 2013. 5. This decision, with which the decision of the Administrative Court becomes final (Section 124a (5) sentence 4 VwGO), is final (Section 152 (1) VwGO; Section 68 (1) sentence 5, Section 66 (3) sentence 3 GKG ).