OVG RLP - 7 B 10360/23: Difference between revisions

Revision as of 08:43, 24 October 2023

OVG RLP - 7 B 10360/23

Court:	OVG RLP (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(e) GDPR Article 6(1)(f) GDPR German Road Traffic Licensing Regulations
Decided:	20.06.2023
Published:
Parties:	VG Mainz
National Case Number/Name:	7 B 10360/23
European Case Law Identifier:
Appeal from:	VG Mainz 3 L 108/23
Appeal to:	Unknown
Original Language(s):	German
Original Source:	JURIS (in German)
Initial Contributor:	Sainey Belle

A German court held that according to Article 6(1)(f) GDPR a car owner is obliged to disclose to the authority personal data of a car driver in light of the public authority's legitimate interest to prosecute traffic offences.

English Summary

Facts

The controller was a company that allowed their employees to use the company vehicle. One of these cars was used to commit traffic offences. During the police investigation, it was not established which employee had driven the car at that time. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law.

The controller refused to comply with the order and appealed it before a court. The controller argued that the GDPR precludes the disclosure of personal data of the driver(s) to the authorities and the keeping of a logbook with the drivers' names.

The first instance court rejected the claim and the controller appealed the decision before the Higher Administrative Court of Rhineland-Palatinate (Oberverwaltungsgericht Rheinland-Pfalz, OVG Rheinland-Pfalz).

Holding

The court of appeal upheld the first instance judgement.

According to the court, both the disclosure of personal data of the drivers and the keeping of a log with personal data of the latter were permissable pursuant to Article 6(1)(f) GDPR. As a legal basis, the controller could (and should) rely on the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. Moreover, the court observed how the further stages of the processing were also permissable from the public authority side under Article 6(1)(e) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

If you see this message, you do not have JavaScript activated in your browser. Please activate JavaScript to use the citizen service.

@@ Line 66: / Line 66: @@
 }}
-The Higher Administrative court of Rhineland-Palatinate held that the provision of data to authorities for driving offences on a company car is permitted per [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]].
+A German court held that according to [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] a car owner is obliged to disclose to the authority personal data of a car driver in light of the public authority's legitimate interest to prosecute traffic offences.
 == English Summary ==
 === Facts ===
-The applicant in the present case - the controller - is a vehicle owner that provides cars to third parties. One of these cars was used to commit traffic offences. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law.
+The controller was a company that allowed their employees to use the company vehicle. One of these cars was used to commit traffic offences. During the police investigation, it was not established which employee had driven the car at that time. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law.
 The controller refused to comply with the order and appealed it before a court. The controller argued that the GDPR precludes the disclosure of personal data of the driver(s) to the authorities and the keeping of a logbook with the drivers' names.
@@ Line 78: / Line 78: @@
 === Holding ===
-The controller was a company who allowed their employees to utilise the company vehicle. Two traffic violations were committed on June 11 2022 and September 6 2022 and it was not established which employee had driven the car at that time. The authorities attempted to conduct an investigation in order to ascertain the driver by questioning the employees during four onsite checks. The employees were not very cooperative and the managing director was not available during any of the onsite visits. Per the court, the authorities questioning of the employees was sufficient as an investigative measure. It is the responsibility of the company to ensure internally that the management team or the employees who can reasonably provide reliable information about the use of company cars are informed. As the company were not very cooperative with the authorities, they were no longer expected to continue digging for information.
+The court of appeal upheld the first instance judgement.
-The controller sought to rely on the GDPR for its refusal to provide the name of the driver. As per the court, the disclosure of the personal data of the driver would permissable pursuant to [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] for the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. And, as per the jurisprudence in VG Regensburg, Urteil vom 17. April 2019 – RN 3 K 19.267 –, juris Rn. 30, it is also permissable per [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]].
+According to the court, both the disclosure of personal data of the drivers and the keeping of a log with personal data of the latter were permissable pursuant to [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. As a legal basis, the controller could (and should) rely on the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. Moreover, the court observed how the further stages of the processing were also permissable from the public authority side under [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]].
-The court also highlighted the importance of keeping a logbook as appropriate commercial practice. It was of the opinion that, although this may have been a nuisance, it was necessary and sufficient. Pursuant to Section 31a, para 1 of the German Road Traffic Licensing Regulations, the administrative authority may order a vehicle owner to keep a logbook for vehicles registered in their name.
 == Comment ==