LfDI (Baden-Württemberg) - 21/09/2022

LfDI - Data from the land register is not freely available for use
Authority:	LfDI (Baden-Württemberg)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(f) GDPR Article 14 GDPR §12 GBO
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	21.09.2022
Fine:	55000 EUR
Parties:	n/a
National Case Number/Name:	Data from the land register is not freely available for use
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	German
Original Source:	LfDI (in DE)
Initial Contributor:	n/a

The DPA of Baden-Wuerttemberg (LfDI) issued fines of €50,000 against a real estate development company and €5,000 against a surveyor for misuse of land register data in violation of Articles 6(1)(f) and 14 GDPR.

English Summary

Facts

A property owner (the data subject) received a letter from a real estate developer (the first controller) offering them a purchase price for their property. The letter did not contain any information about the origin of the data, and when asked, the controller did not disclose where they had obtained the data from.

Subsequently, the fines office at the LfDI determined that a surveyor (the second controller) had made use of their authority to inspect the electronic land register using the automated retrieval procedure, identified several hundred property owners without their knowledge and passed the corresponding information on to the first controller.

Holding

Violation of Article 6(1)(f) GDPR

The LfDI decided that the case at hand constituted a breach of Article 6(1) GDPR. When weighing the interests in the context of Article 6(1)(f) GDPR, it must be taken into account that there was no prior business relationship between the data subject and the first controller and that the data subjects did not have to assume that their data would be available in the land register for promotional approaches. In this context, the fact that property owners cannot object to the entry in the land register nor to the transfer of data is of particular importance since their data is collected on the basis of a statutory obligation which is not intended to serve advertising purposes.

Violation of Article 14 GDPR

Furthermore, the LfDI decided that the case at hand constituted a breach of Article 14 GDPR since the data subject was not provided with any information on data processing. This was based on the fact that the right to information is an essential prerequisite for data subjects to be able to assert other rights under the GDPR. The exemption under Article 14(5)(c) GDPR was not applicable since neither the body collecting the data nor the scope, purpose or duration of the data collection were apparent to the data subject when they were inspected by third parties under §12 of the Grundbuchordnung (GBO, German land register code).

Fine assessment

The LfDI imposed fines of €50,000 on the first controller and €5,000 on the second controller. When calculating the fine, the LfDI took into account the number of data subjects, the type of data involved, the significance of the violated provisions, and the cooperation of the responsible entities. The fines were accepted by the responsible parties and therefore became legally binding.

Comment

This summary was written based on a press release, as the official decision has not been published yet. For the same reason, the relationship between the real estate development company and surveyor as data controllers could not be clearly established. Furthemore, the press release does not make it clear whether this is a complaint procedure or an ex officio investigation by the DPA.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

LfDI Baden-Württemberg has imposed fines for improper use of land register data
Data from public registers such as the land register are also not freely available
The state representative Dr. Stefan Brink: “Those responsible should be aware that public data also enjoys protection and is not freely available. The fines imposed in the present case make it clear that clandestine data processing using special access rights does not pay off. The General Data Protection Regulation also applies in the highly competitive building land market.”
The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg has imposed fines of EUR 50,000 and EUR 5,000 on a property developer and a surveyor for illegal data collection and transfer and breaches of information obligations.
A property owner in a new development area had received a letter from a property developer in which he was offered a purchase price for his property. The letter did not contain any information about the origin of his data, and even when asked, the addressee was not told where the developer got his data from, in particular the knowledge of his position as owner.
The fine office at the State Commissioner then determined that a surveyor had made use of his authorization to inspect the electronic land register in the automated retrieval process and in two cases had identified several hundred property owners without their knowledge and passed on the relevant information to a property developer. The latter, in turn, wrote to the owners determined in this way with a purchase price offer for their properties without providing the necessary information according to Art. 14 DS-GVO, in particular without informing about the origin of the data.
On the one hand, this procedure constitutes a violation of Art. 6 Para. 1 DS-GVO. When weighing up interests within the scope of Art. 6 Para. 1 Letter f DS-GVO, it must be taken into account that no prior business relationship existed and the owners did not have to assume that their data would be available in the land register for advertising purposes. The fact that property owners can neither object to the entry in the land register nor to the transmission of data is of particular importance here, rather their data is collected on the basis of a legal obligation. However, this legal obligation does not serve to address advertising, but rather to ensure legal certainty in real estate transactions. Accordingly, it is also generally recognized for the right to inspect the land register that a sole interest in acquisition does not entitle to inspect, rather concrete contract negotiations are required.
In addition, there was also a violation of Art. 14 DS-GVO in that the owners were not provided with any information on data processing, even when they were contacted. However, this information is an essential prerequisite for data subjects in order to be able to assert their rights under Art. 15 et seq. DS-GVO. There was also no reason for exclusion in the present case, in particular § 12 GBO does not constitute a legal regulation within the meaning of Art. 14 Para. 5 Letter c DS-GVO, since neither the data-collecting body nor The scope, purpose or duration of the data collection can be seen.
When assessing the fine, in addition to the number of people affected, the type of data affected and the importance of the violated regulations, the cooperation of the responsible bodies in the fine procedure was taken into account.
The fines were accepted by those responsible and are now legally binding.
For questions you can contact us on the telephone number
0711/615541-23 and by email: pressestelle@lfdi.bwl.de
Further information on data protection and freedom of information can be found on the Internet at www.baden-wuerttemberg.datenschutz.de or at www.datenschutz.de.