OVG Hamburg - 3 Bs 146/23: Difference between revisions
From GDPRhub
(clarified facts; put facts/holding in chronological order) |
(added clarifications as to the plaintiff/defendant; clarified holding of the first instance court; formatted the names of national laws.) |
||
| Line 73: | Line 73: | ||
=== Facts === | === Facts === | ||
The data subject as a plaintiff in this case, was a candidate for the election of the students' parliament at the University of Hamburg. Upon signing up for candidacy he disputed the processing of his date of birth in the candidacy registration form as he claimed this to be unnecessary and filed suit with the Administrative Court of Hamburg (''Verwaltungsgericht Hamburg, VG Hamburg'') | The data subject as a plaintiff in this case, was a candidate for the election of the students' parliament at the University of Hamburg. Upon signing up for candidacy he disputed the processing of his date of birth in the candidacy registration form as he claimed this to be unnecessary and filed suit against the member organisation of the University with the Administrative Court of Hamburg (''Verwaltungsgericht Hamburg, VG Hamburg'') | ||
The data processor is the University of Hamburg, a legal entity under public law of the | The data processor, or defendant, is the University of Hamburg, a legal entity under public law of the City of Hamburg. The Hamburg Election Regulation (''Wahlordnung, WahlO'') stipulates that to be able to run for elections, every candidate must provide their full name, student number, date of birth, current home address and an email address. In its submissions, the processor argued that processing the date of birth of candidates was necessary for the purpose of identifying them beyond doubt and ensuring that the candidates were of legal age. | ||
On 11 February 2023, the VG Hamburg, in the first instance, held that the plaintiff's candidacy registration form was incomplete because the required date of birth was missing and that this requirement does not raise any data protection concerns. Hence, the court took the view that he had not submitted a complete form in a timely manner and therefore could not run for election. | |||
On 11 February 2023, the VG Hamburg, in the first instance, held that the plaintiff's candidacy registration form was incomplete | |||
The data subject thus decided to appeal the decision to the Higher Administrative Court of Hamburg (''Oberverwaltungsgericht Hamburg, OVG Hamburg''). | The data subject thus decided to appeal the decision to the Higher Administrative Court of Hamburg (''Oberverwaltungsgericht Hamburg, OVG Hamburg''). | ||
| Line 85: | Line 83: | ||
=== Holding === | === Holding === | ||
The OVG Hamburg | The OVG Hamburg first of all held that the GDPR applies because the date of birth of a data subject constitutes personal data and its use in the context of the election is to be considered data processing. | ||
Further, the OVG held that the only legal basis for such data processing would be [[Article 6 GDPR#1e|Article 6(1)(e)]] GDPR. In this respect, the court assessed whether the processing of the plaintiff's birth date could be considered necessary on the basis of [[Article 5 GDPR]] and [[Article 6 GDPR]] for the purpose of unambiguously identifying the candidates or future members of the student parliament. In particular, the OVG held that, in this, the principle of data minimisation as laid down in [[Article 5 GDPR#1c|Article 5(1)(c)]] GDPR, has to be taken into account. According to this principle, personal data must be relevant and limited to what is necessary for the purposes of processing. The CJEU in its [[CJEU - C-175/20 - Valsts ieņēmumu dienests|judgment C-175/20]], clarified that this must be limited to "what is strictly necessary", implying a strict standard in ascertaining whether or not the processing is necessary. | |||
Considering all these elements, the court held that the purpose of unambiguously identifying the persons registering as candidates could be achieved without processing their date of birth, as the remaining data were sufficient to fulfil this purpose. The court also pointed out that it was not necessary to use the date of birth to ensure that the candidates were over 18, since underage registered students are also eligible for the Student Parliament. | |||
In light of this, the OVG held that the provision in Section 6(5) WahlO is not in accordance with the legal basis in [[Article 6 GDPR#1e|Article 6(1)(e)]] GDPR combined with Section 4 Hamburg Data Protection Law (''Hamburgisches Datenschutzgesetz, HambDSG'') as the processing of candidates' birth dates cannot be considered necessary for the pursued purposes and it goes against the principle of data minimisation under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR.]] | |||
Thus, the OVG Hamburg overturned the VG Hamburg's decision to reject the plaintiff's candidacy and held that the defendant must accept the plaintiff's candidacy and include him on the electoral list. | |||
== Comment == | == Comment == | ||
Revision as of 15:35, 19 January 2024
| OVG Hamburg - 3 Bs 146/23 | |
|---|---|
 | |
| Court: | OVG Hamburg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5 GDPR Article 5(1)(c) GDPR Article 6 GDPR Article 6(1)(e) GDPR § 4 HmbDSG |
| Decided: | 29.11.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 3 Bs 146/23 |
| European Case Law Identifier: | |
| Appeal from: | Verwaltungsgerichts Hamburg 2 E 4998/23 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Hamburg state law portal (in German) |
| Initial Contributor: | lacrosse |
The Higher Administrative Court of Hamburg held, on appeal, that the processing of personal data in connection with the students' parliament election of the University of Hamburg failed to comply with Article 5(1)(c) GDPR.
English Summary
Facts
The data subject as a plaintiff in this case, was a candidate for the election of the students' parliament at the University of Hamburg. Upon signing up for candidacy he disputed the processing of his date of birth in the candidacy registration form as he claimed this to be unnecessary and filed suit against the member organisation of the University with the Administrative Court of Hamburg (Verwaltungsgericht Hamburg, VG Hamburg)
The data processor, or defendant, is the University of Hamburg, a legal entity under public law of the City of Hamburg. The Hamburg Election Regulation (Wahlordnung, WahlO) stipulates that to be able to run for elections, every candidate must provide their full name, student number, date of birth, current home address and an email address. In its submissions, the processor argued that processing the date of birth of candidates was necessary for the purpose of identifying them beyond doubt and ensuring that the candidates were of legal age.
On 11 February 2023, the VG Hamburg, in the first instance, held that the plaintiff's candidacy registration form was incomplete because the required date of birth was missing and that this requirement does not raise any data protection concerns. Hence, the court took the view that he had not submitted a complete form in a timely manner and therefore could not run for election.
The data subject thus decided to appeal the decision to the Higher Administrative Court of Hamburg (Oberverwaltungsgericht Hamburg, OVG Hamburg).
Holding
The OVG Hamburg first of all held that the GDPR applies because the date of birth of a data subject constitutes personal data and its use in the context of the election is to be considered data processing.
Further, the OVG held that the only legal basis for such data processing would be Article 6(1)(e) GDPR. In this respect, the court assessed whether the processing of the plaintiff's birth date could be considered necessary on the basis of Article 5 GDPR and Article 6 GDPR for the purpose of unambiguously identifying the candidates or future members of the student parliament. In particular, the OVG held that, in this, the principle of data minimisation as laid down in Article 5(1)(c) GDPR, has to be taken into account. According to this principle, personal data must be relevant and limited to what is necessary for the purposes of processing. The CJEU in its judgment C-175/20, clarified that this must be limited to "what is strictly necessary", implying a strict standard in ascertaining whether or not the processing is necessary.
Considering all these elements, the court held that the purpose of unambiguously identifying the persons registering as candidates could be achieved without processing their date of birth, as the remaining data were sufficient to fulfil this purpose. The court also pointed out that it was not necessary to use the date of birth to ensure that the candidates were over 18, since underage registered students are also eligible for the Student Parliament.
In light of this, the OVG held that the provision in Section 6(5) WahlO is not in accordance with the legal basis in Article 6(1)(e) GDPR combined with Section 4 Hamburg Data Protection Law (Hamburgisches Datenschutzgesetz, HambDSG) as the processing of candidates' birth dates cannot be considered necessary for the pursued purposes and it goes against the principle of data minimisation under Article 5(1)(c) GDPR.
Thus, the OVG Hamburg overturned the VG Hamburg's decision to reject the plaintiff's candidacy and held that the defendant must accept the plaintiff's candidacy and include him on the electoral list.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Guiding principle
The processing process associated with the obligation to note the date of birth on the candidacy form for the election to the student parliament, as provided for in Section 6 Paragraph 5 Sentence 1 Election Code, takes into account the principle of data minimization in the absence of necessity anchored in Article 5 Paragraph 1 Letter c) GDPR not in accordance with Article 6 Paragraph 1 Subparagraph 1 Letter e) GDPR in conjunction with Section 4 HmbDSG.
Hide procedure procedure procedure
proceeding VG Hamburg, February 11, 1923, 2 E 4998/23, decision
tenor
In response to the complaint of the applicant 3), the decision of the Hamburg Administrative Court of November 24, 2023, insofar as the application of the applicant 3) was rejected, will be changed, with the exception of the determination of the amount in dispute.
By way of an interim order, the respondent is obliged to provisionally admit the applicant 3) to the overall list of the “List LINKS Open List of Foreigners * Left List * Other Actives” for the election to the student parliament for the 2024/2025 electoral period.
The respondent bears the costs of the appeal proceedings.
The first instance decision on costs is changed to the effect that the respondent bears 2/3 of the court costs, the extrajudicial costs of the applicant 2) and the applicant 3) as well as 2/3 of their extrajudicial costs and the applicant 3) bears no costs . With regard to the cost decision regarding applicants 1) and 2), the decision of the administrative court remains unchanged.
The amount in dispute for the appeal procedure is set at 5,000 euros.
reasons
I
Paragraph 1
The admissible complaint is successful on the merits.
Paragraph 2
The decision of the administrative court must be changed for the reasons explained (Section 146 Paragraph 4 Sentence 3 and 6 VwGO), and the applicant 3) is entitled to interim legal protection in accordance with Section 123 VwGO with regard to the rejection of his candidacy registration for December 2023 and January To grant the respondent the new election of the student parliament to take place in 2024 for the 2024/2025 electoral period.
Paragraph 3
1. In its decision of November 24, 2023, the administrative court denied applicant 3)'s claim to candidacy on the grounds that he had not submitted an application containing the required information about his date of birth either during the regular submission period or during the defect correction period and that there are no data protection concerns regarding the requirement to state the date of birth. The applicant 3) rightly complains in his grounds of complaint that the collection of his date of birth violates the data protection principle of data minimization because it is not necessary.
Paragraph 4
2. If the examination of the reasons presented in accordance with Section 146 Paragraph 4 Sentence 6 VwGO shows, as here, that the contested decision cannot stand based on the reasons given by the administrative court, the application must be examined summarily but comprehensively by the appeal court independently . According to this, the applicant 3) has credibly demonstrated both a reason for the order and a claim to candidacy for membership in the student parliament with the high degree of probability required for the issuance of an interim order in anticipation of the main matter (§ 123 para. 1 and 3 VwGO; §§ 920 paragraph 2, 294 paragraph 1 ZPO).
Paragraph 5
a) A reason for the order justifying the anticipation of the main issue arises from the fact that the applicant 3) could no longer stand as a candidate in the election that is immediately about to be held due to the denial of interim legal protection. After the respondent's election announcement, the final approved individual candidates and overall lists should be announced on November 19, 2023. According to Section 7 Paragraph 3 Sentence 1 of the regulations for elections to the student parliament (Election Regulations - WahlO) of October 15, 2015 (Amtl. Anzeiger, p. 1877), last amended by Article 1 of the statutes of November 21, 2022 (Amtl. Anzeiger , p. 1824), following the decision on the objections, the finally admitted individual candidates and overall lists, including the ranking and names of the candidates on the overall lists, must be announced in an appropriate manner. According to Section 8 Para. 1 WahlO, the Presidium of the Student Parliament provides information in an appropriate manner about the election of the Student Parliament. In addition, according to Section 8 Para to inform the election and to give individual candidates and general lists the opportunity to introduce themselves. According to Section 10 Paragraph 1 Sentence 1 WahlO, the postal voting documents must be sent no later than the start of the election period on December 11, 2023.
Paragraph 6
b) The applicant 3) has also credibly demonstrated a claim to a candidacy for membership in the student parliament, which justifies the anticipation of the main issue. The applicant 3)'s claim to candidacy is not contradicted by the fact that he did not indicate his date of birth on the “registration form 1 (candidacy form)” submitted in accordance with Section 6 Paragraph 2 No. 1 WahlO to register for candidacy, contrary to the provisions of Section 6 Paragraph 5 Sentence 1 WahlO noted. Candidacy registrations that are incomplete or do not meet the material and formal requirements of paragraphs 2 to 8 of Section 6 WahlO must be rejected in whole or in part by the Presidium of the Student Parliament in accordance with Section 6 Paragraph 9 Sentence 1 No. 2 WahlO. The applicant 3) also did not submit his date of birth within the deadline for correcting defects in Section 7 Paragraph 2 WahlO (and not otherwise). However, the obligation to note the date of birth on the “registration form 1” stipulated in Section 6 Paragraph 5 Sentence 1 of the Election Code violates higher-level data protection law and therefore cannot apply.
Paragraph 7
The data collection associated with the obligation to note the date of birth when registering for candidacy is a processing operation relevant to data protection law. According to Article 4 No. 2 GDPR, processing occurs in every process carried out with or without the help of automated processes or in every series of processes in connection with personal data, such as collecting, recording, organizing, organizing, storing, the adaptation or modification, the reading, the query, the use, the disclosure by transmission, distribution or any other form of provision, the comparison or the combination, the restriction, the deletion or the destruction. Dates of birth are - like the other data to be recorded in accordance with Section 6 Paragraph 5 Sentence 1 WahlO (full name, matriculation number, date of birth, current residential address and an email address) - personal data within the meaning of the General Data Protection Regulation. According to Art. 4 No. 1 GDPR, personal data is all information that relates to an identified or identifiable natural person; A natural person is considered to be identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Paragraph 8
This processing operation, which is accompanied by the obligation to note the date of birth provided for in Section 6 Paragraph 5 Sentence 1 WahlO, is not in accordance with the legal basis of Article 6 Paragraph 1 Subparagraph 1 Letter e) GDPR in conjunction with Section 4 that is the only relevant legal basis here HmbDSG.
Paragraph 9
According to Art. 6 Paragraph 1 Subparagraph 1 e) GDPR, data processing is (only) lawful if it is necessary for the performance of a task that is in the public interest or is carried out in the exercise of official authority vested in the person responsible. Although this provision cannot in itself justify a processing operation, it requires specification or - according to the wording of the standard - "stipulation" in Union law or in the law of the Member States to which the controller is subject, in accordance with Article 6 (3) of the GDPR . However, such a determination is contained in Section 4 HmbDSG, which creates a general legal basis for data processing on the basis of Article 6 Paragraph 1 Subparagraph 1 Letter e) GDPR in conjunction with Article 6 Paragraph 3 Sentence 1 GDPR (see draft a law to adapt the Hamburg Data Protection Act and other regulations to Regulation (EU) 2016/679), Bü-Drs. 21/11638, p. 18). According to Section 4 HmbDSG, the processing of personal data by one of the public bodies mentioned in Section 2 Paragraph 1 HmbDSG is permitted if it is necessary to fulfill the task within the responsibility of the controller or in the exercise of official authority vested in the controller . However, the requirements of this regulation are not met in the present case.
Paragraph 10
The administrative court rightly assumed that Section 2 Paragraph 1 No. 4 HmbDSG, according to which the Hamburg Data Protection Act applies to the processing of personal data by legal entities under public law and their bodies organized under public law that are subject to the supervision of the Free and Hanseatic City of Hamburg also applies to the respondent, which is a legal entity of the University of Hamburg in accordance with Section 102 Paragraph 1 Sentence 2 HmbHG and is under the legal supervision of the competent authority in accordance with Section 5 HmbHG.
Paragraph 11
However, based on the following principles, the processing operation associated with the obligation to note the date of birth provided for in Section 6 Paragraph 5 Sentence 1 of the WahlO is not necessary.
Paragraph 12
The concept of necessity in Section 4 HmbDSG is to be determined based on Articles 5 and 6 GDPR. As a component of Union law, the General Data Protection Regulation enjoys priority in application, with the result that - to the extent that its regulations are not directly applicable anyway - member state law must be interpreted in accordance with European law. In particular, the principle of data minimization enshrined in Article 5 Paragraph 1 Letter c) GDPR must be taken into account, which in turn takes into account the right to protection of personal data under Article 8 Paragraph 1 of the Charter of Fundamental Rights. According to this, personal data must be appropriate and relevant to the purpose and limited to what is necessary for the purposes of processing (“data minimization”). Whether data processing is “necessary” in an individual case is determined according to this principle. A strict standard must be applied when assessing necessity. According to the case law of the Court of Justice of the European Union, data processing is necessary if it is limited to “what is absolutely necessary” (cf. ECJ, judgment of February 24, 2022, C-175/20, juris para. 73 with further references). As shown by the wording of Article 5 Paragraph 1 Letter b) GDPR (“specified […] purposes”) and the wording in Recital 39 Sentence 6 GDPR, (“In particular, the specific purposes for which the personal data are processed, must be clear and lawful and established at the time the personal data is collected.”), the purposes for which data is collected and further processed must already be determined at the time of data collection or other processing (see also Article 8 para. 2 sentence 1 of the Charter of Fundamental Rights). The definition of the purposes also determines the necessary extent of data processing to which the collection is to be limited. However, the principle of data minimization must not be ignored when determining a purpose for the processing of personal data. In particular, this principle must not be circumvented by an overly broad purpose for data processing, which would make it possible to process data for possible requirements in a procedure at a time when these requirements have not yet become sufficiently clear (cf. OVG Münster , judgment of June 15, 2022, 16 A 857/21, DVBl 2023, 95, juris para. 49 ff. m.w.N.).
Paragraph 13
According to these provisions, it is not apparent that the processing operation associated with the obligation to note the date of birth provided for in Section 6 Paragraph 5 Sentence 1 of the WahlO is necessary.
Paragraph 14
aa) The data to be recorded in accordance with Section 6 Paragraph 5 Sentence 1 WahlO (full name, matriculation number, date of birth, current residential address and an email address) is evidently used to make the respondent's decision on the applicant's objection to 3). against the rejection of his candidacy registration dated November 19, 2023 for the “clear identification of people/candidates or possibly later members of the student parliament, which is necessary for various processes”.
Paragraph 15
With regard to this processing purpose, the aforementioned personal data relating to date of birth are not limited to what is necessary. The fact that the data must be limited to what is necessary means, in particular, that the amount of data must be limited in such a way that additional data - which may be appropriate and significant in themselves - may not be processed if the purpose of the processing is also without it can be achieved (see Herbst, in: Kühling/Buchner, DS-GVO BDSG, 4th edition 2024, DS-GVO, Art. 5 Rn. 57; Roßnagel, in: Simitis/Hornung/Spiecker gen. Döhmann, Data protection law, 1st edition 2019, GDPR, Art. 5 Rn. 121; similarly also Reimer, in: Sydow/Marsch, DS-GVO | BDSG, 3rd edition 2022, GDPR, Art. 5 Rn. 35) . In the present case, the purpose stated by the respondent of clearly identifying the persons registering for candidacy can also be achieved without the date of birth having to be noted. If such a person has provided the remaining data to be recorded in accordance with Section 6 Paragraph 5 Sentence 1 WahlO on “Registration Form 1”, it is no longer necessary to state the date of birth in order to identify this person.
Paragraph 16
The appeal court cannot see in which constellations the date of birth, which was only made mandatory in the statutes amending electoral provisions of November 21, 2022 (Amtl. Anzeiger, p. 1824), is essential for identification. If there is an inaccuracy in the remaining data to be recorded in accordance with Section 6 Paragraph 5 Sentence 1 WahlO in individual cases - be it due to a temporary change of name, a typographical error in the matriculation number or a change in contact details - the person concerned should be identified Person can either be possible with the existing data without the date of birth or cannot be done using the date of birth without remaining relevant doubts. In the case of serious deficiencies, such as the provision of the name, it is inconceivable from the appeal court's point of view that a stated date of birth (possibly in combination with other information) could help to overcome this and avoid the need for further clarification. Insofar as the respondent - as can be seen from the contested decision (BA p. 15) - argued before the administrative court that the date of birth is the only unchangeable characteristic that, together with the matriculation number, enables 100% error-free identification, the appeal court does not understand that Why a clear personal identification requires not only knowledge of the person's clearly assigned and fundamentally unchangeable matriculation number, but also the date of birth. Such a need does not appear in view of the respondent's reference to the fact that discrepancies could occur when comparing the names of the 218 people currently running for office with the approximately 44,000 enrolled students and in particular their addresses. With the obligation to record the matriculation number as provided for in Section 6 Paragraph 5 Sentence 1 WahlO, these discrepancies can be regularly resolved in the absence of any evidence to the contrary. The respondent's opinion, presented before the administrative court, that it must have a reliable set of instruments at its disposal, in particular to compare the identities of the students running, if necessary on a random basis, so that no exmatriculated persons or other third parties are elected as elected representatives in the student parliament (BA p. 15), ultimately cannot justify the necessity of the processing process associated with the obligation to note the date of birth provided for in § 6 Para the student status can be closed.
Paragraph 17
bb) In the case of the purpose of querying the date of birth in “registration form 1”, which was presented for the first time in the administrative court proceedings by the respondent in a written statement dated November 22, 2023, that the person behind the candidacy registration is an adult and therefore fully legally competent (p . 89 d.A. of the VG), it can be left open whether this purpose was already determined at the time of data collection or other processing. Data processing aimed at this is also not necessary. In particular, the passive right to vote depends on Article 14 Paragraph 3 of the statutes of the student body of the University of Hamburg (main statutes) in the version dated March 1, 1974 (Amt. Anzeiger, p. 349), last amended on March 7, 2023 (Amtl. Anzeiger, p. 361) does not depend on the date of birth. Underage enrolled students are also eligible.
Paragraph 18
Insofar as the respondent - as can be seen from the contested decision (BA p. 15) - also argued before the administrative court that it was necessary for the elected members of the student parliament to make declarations in accordance with the General Data Protection Regulation or on the right to their own image, it follows There is no other result from this. Regardless of the fact that applicant 3) denies in his grounds of appeal that the members of the student parliament would have had to make such declarations in the past, and the question of whether these declarations are even necessary, this broad purpose for data processing leads to one inadmissible circumvention of the principle of data minimization because it would make it possible to process data for possible requirements in a procedure at a time when these requirements have not yet become sufficiently clear. It should be taken into account that the people who register their candidacy are not yet elected members of the student parliament and their election cannot (in any case) be predicted with certainty. If the newly elected members of the student parliament for the 2024/2025 electoral period have to make declarations of the aforementioned type and knowledge of the member's age is important in order to assess the effectiveness of such a declaration, the date of birth would only be collected in due course. Insofar as the administrative court has raised concerns in this regard that elected members of the student parliament could refuse to provide information without this having consequences for their mandate (BA p. 16), this does not justify the necessity of the sentence in Section 6 Paragraph 5 1 WahlO's obligation to note the date of birth. It may be conceivable that in individual cases a newly elected member who is not obviously fully legally competent refuses to provide his or her date of birth if this should be queried with regard to the declarations in question. In the opinion of the appeal court, however, this does not justify collecting the birth dates of all candidates “in reserve”. This would be a blatant disproportion.
II.
Paragraph 19
The cost decision follows from Sections 154 Paragraph 1, 155 Paragraph 1 Sentence 1 VwGO.
III.
Paragraph 20
The determination of the amount in dispute for the appeal procedure is based on Sections 47 Paragraph 1 Sentence 1, 52 Paragraph 1, 53 Paragraph 2 No. 1 GKG. Based on No. 1.5, 18.12 of the Catalog of Values in Dispute for Administrative Courts 2013, the default value is taken into account in full due to an anticipation of the main case.
