OLG Köln - 15 U 60/23

OLG Köln - 15 U 60/23
Court:	OLG Köln (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 4(7) GDPR Article 17 GDPR
Decided:	04.07.2024
Published:	15.07.2024
Parties:	Google Ireland Limited Google Limited Liability Company
National Case Number/Name:	15 U 60/23
European Case Law Identifier:
Appeal from:	LG Köln (Germany) 28 O 157/21
Appeal to:
Original Language(s):	German
Original Source:	Rechtsprechungsdatenbank NRW (in German)
Initial Contributor:	ec

A court held that Google Ireland limited, as the operator of the Google search engine, is a controller for displaying search results, irrespective of the fact that the search results are provided by the US based Google LLC.

English Summary

Facts

The data subject filed a lawsuit with the first instance court, the Regional Court of Cologne (“Landgerichts Köln”) seeking injunctive relief. The data subject further requested the court to order Google Ireland Limited (the controller) to erase search results that linked to an article which contained false information about the data subject and included a photograph of the data subject that infringed the data subject’s copyright. The article used the photograph to make allegations of the data subject. The photograph was taken by the data subject’s wife, who did not give the website the right to use the photograph for the mentioned article.

The first instance court agreed with Google Ireland's view that they are not the controller, but the US based Google Limited Liability Company (LLC), because they make the decisions about how to respond to a search query and how the relevant search results are displayed. Google LLC was also named as the controller in the privacy policy. Although Google Ireland Limited operates the Google search engine in Germany and other European countries, it had no influence on how the search results were generated. The court therefore dismissed the action for injunctive relief and request for erasure.

The data subject appealed the decision of the first instance court for failing to recognise that Google Ireland Limited is a controller under Article 4(7) GDPR. It further requested the court to erase the search results related to the article with inaccurate information of the data subject.

Holding

On whether Google Ireland Limited is a controller

The court disagreed with the first instance court and held that Google Ireland Limited is the controller. The court held that it is irrelevant whether the controller only offers access to the search engine and took into account the CJEU judgement in C-131/12 - Google Spain and C-231/22 - Belgian State and held that the mere display of information containing personal data constitutes the processing of such data. The fact that the company itself does not decide which and how search results are displayed is therefore irrelevant according to the court. By offering German internet users access to the search engine, it provided users with the search results prepared by its parent company Google LLC and thus carried out data processing within the meaning of Article 4(2) GDPR.

The court further noted that naming Google LLC the controller in the privacy policy did not release Google Ireland Limited from its own responsibility in connection with data protection.

On the unlawful processing

The court took into account the CJEU’s judgement in C-460/20 - TU, RE v Google and held that the operator of a search engine is obliged to grand a request for erasure if the data subject can provide sufficient evidence that the information contained in the search results is manifestly inaccurate or at least part of it.

The court found that the data subject provided enough evidence that showed that the article provided inaccurate claims about the data subject. When weighing up the data subject’s interests, the court took into account the fact that the false allegation constituted criticism of the data subject and was therefore not value-neutral.

Therefore, the court held that the data subject’s personal data was processed unlawfully under Article 17(1)(d) GDPR and that the processing was also not necessary for exercising the right of freedom of expression and information under Article 17(3)(a) GDPR. The court therefore ordered the controller to delete the search results that linked to the article in question.

On the claim for injunctive relief

The court held that Article 17(1) GDPR grants the data subject a right to injunctive relief in addition to the right to erasure. The court imposed a fine of up to € 250,000 for each violation if the controller violates the injunctive order.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

1Reasons:
2I.
3The plaintiff OM. was an assessor on the board of the S.-X. district association of the Z. party from the beginning to the end of 2019. The defendant operates the Mn. search engine in Germany and other European countries. With his lawsuit, the plaintiff objects to the fact that in the Federal Republic of Germany, the MN. search results link to an article published on 00.00. 2019 with the headline "Quote has been removed" (Appendix B 1 to the statement of defense). The article takes a critical look at various local politicians from the Z. party and also contains statements about the plaintiff in two paragraphs. Next to the first of these paragraphs is a photograph taken by the plaintiff's wife showing the plaintiff in a uniform. By written contract dated March 15, 2021, the plaintiff's wife granted him the unrestricted right to use the photograph extensively.
4The regional court, whose judgment is referred to for the details of the facts and the first instance applications, dismissed the action for injunctive relief and, alternatively, deletion, because the defendant was not liable.
5In his appeal against this, the plaintiff complains that the regional court failed to recognize, in a way that was relevant to the decision, that the defendant was the controller within the meaning of Art. 4 No. 7 GDPR.
6The plaintiff, after withdrawing the appeal application under item 2 aimed at reimbursement of pre-trial legal costs and amending his other applications following advice from the Senate, requests, in the same way,
7               amending the contested judgment
8               1. to instruct the defendant as is clear from the operative part,
93. alternatively, to instruct the defendant to delete or delist the URL https://M..G..org/"was removed" and/or the URL https://M..net/"was removed" with the article entitled ""Quote was removed"" in the Federal Republic of Germany on its domain MN..de in the MN. search results, if the above-mentioned article contains the photograph shown in the operative part and if this happens as on 00.00 2022 and as is clear from the article shown in the operative part under letter a,
11and/or
12b) when entering the Tenor under letter b to delete or delist the search terms reproduced if the above-mentioned article contains a picture of the plaintiff and if this happens in each case as on 00.00 2022 and as can be seen from the article shown on pages 20 and 21 of the grounds of appeal.
13The defendant requests that
14               the appeal be dismissed.
15It defends the contested decision.
16II.
171. According to the Cologne Higher Regional Court's business distribution plan for the 2024 financial year, which corresponds in the relevant provisions to the business distribution plan for the 2023 financial year, the Senate is responsible for the present appeal proceedings.
18According to point 1 letter e of the provisions of the business distribution plans concerning the Senate, the Senate is responsible for appeals in disputes that primarily concern claims under the General Data Protection Regulation, insofar as the jurisdiction of the 6th Civil Senate is not affected. On this basis, the Senate has affirmed its jurisdiction in this case, although the plaintiff, in addition to a delisting request based on Art. 17 GDPR (application 1 b), also asserts a copyright injunction claim (application 1 a), which generally falls within the jurisdiction of the 6th Civil Senate. Based on the meaning and purpose of the aforementioned provisions of the business allocation plans, the Senate has based its decision on the fact that the vast majority of the subject matter of the dispute relates to data protection law, which falls within the Senate's special jurisdiction. However, this can also be left aside. According to section I.3.4.2 of the business allocation plans, a case can no longer be handed over for reasons of the business allocation plan if an oral hearing has taken place in a case.
19The defendant did not challenge the Senate's jurisdiction before the start of the oral hearing. To the extent that it now claims in the non-supplementary written submission of June 26, 2024 that it had to assume that the Senate would not decide on copyright claims, this is incomprehensible. Because with his appeal, the plaintiff also pursued the application under 1 a, based on a copyright infringement. The fact that the regional court justified the dismissal of the entire action only on the grounds that the defendant was not responsible for data protection and that the appeal only attacked this reasoning does not change this.
202. The appeal is successful. Contrary to the opinion of the regional court, the application under 1 is admissible and justified. There is therefore no need to decide on the application under 3, which was made in the alternative in the appeal instance.
21a) The claim for injunctive relief asserted with the application under 1 b follows from Art. 17 para. 1 GDPR.
22aa) In cases in which a data subject - such as the plaintiff in this case - requests the operator of an Internet search engine to delist certain result links, the right to erasure laid down in Art. 17 Para. 1 GDPR is not to be restricted to the simple deletion of data due to the technical requirements of the data processing in question, which are ultimately incalculable for the data subject and are also subject to constant development progress, but rather, regardless of the technical implementation, it also includes the request to refrain from re-listing (cf. BGH, decision of September 26, 2023 - VI ZR 97/22, GRUR 2023, 2472 para. 20 with further references).
23bb) The defendant's liability is not subsidiary to the liability of those persons responsible for publishing the article of 00.00. 2019 (cf. BGH, judgment of May 3, 2022 - VI ZR 832/20, GRUR 2022, 1009 para. 12; cf. also ECJ, judgment of December 8, 2022 - C-460/20, GRUR 2023, 184).
24cc) The application required for the delisting request can in any case be seen in the statement of claim, in which the plaintiff has formally informed the defendant sufficiently clearly of the illegality of the data processing in his view (cf. BGH, judgment of May 23, 2023 - VI ZR 476/18, BGHZ 237, 137 para. 29 with further references). To the extent that the defendant asserted in the oral hearing that the application does not have retroactive effect, this is indeed true. However, for the injunction claim, it is only important that the application is suitable for establishing the defendant's liability under data protection law in the future.
25dd) The article published on the websites referred to in the search results on 00.00. 2019 indisputably contains personal data concerning the plaintiff (Art. 4 No. 1 GDPR).
26ee) Contrary to the opinion of the regional court, the defendant is the controller. According to Art. 4 No. 7 GDPR, the controller is the natural or legal person, public authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data.
27According to the case law of the European Court of Justice, which the Regional Court also based its decision on, the broad definition of the term ‘controller’ is intended to ensure effective and comprehensive protection of the data subject (see ECJ, judgment of 11 January 2024 - C-231/22, NJW 2024, 641 para. 28). The activity of a search engine, which consists in finding information placed on the Internet or published there by third parties, automatically indexing it, temporarily storing it and finally making it available to Internet users in a specific order, is to be classified as processing of personal data within the meaning of Art. 4(1) and (2) GDPR, provided that the information contains personal data. Furthermore, the operator of such a search engine is to be regarded as the controller for this processing within the meaning of Art. 4 No. 7 GDPR (see ECJ, judgment of December 8, 2022 - C-460/20, GRUR 2023, 184 para. 49 with further references). In the present case, it is undisputed that the defendant is the operator of the MN. search engine in Germany and other European countries (see also LG Munich, judgment of March 22, 2023 - 26 O 1037/21, MMR 2023, 602 para. 29).
28It is irrelevant that, according to the defendant's submission, it only offers access to the search engine, while the decisions on how to respond to a search query and how the relevant search results are displayed are not made by it but by MN. LLC. In its differing assessment, the Regional Court, like the Regional Courts of Rostock and Mosbach in their decisions submitted by the defendant as Annex BB 1 (LG Rostock, judgment of 24 May 2023 - 3 O 95/22; LG Mosbach judgment in proceedings 2 O 86/24), did not take into account that, according to the case law of the European Court of Justice, the display of personal data on a page with search results already constitutes a processing of these data (cf. ECJ, judgment of 13 May 2014 - C-131/12, GRUR 2014, 895 para. 57; for a publication see also ECJ, judgment of 11 January 2024 - C-231/22, NJW 2024, 641 para. 28). By offering German Internet users access to the MN. search engine - as it itself has stated - the defendant provides users with the search results prepared by its parent company and thus carries out data processing within the meaning of Art. 4 No. 2 GDPR insofar as personal data is involved (Art. 4 No. 1 GDPR) (cf. ECJ, judgment of May 13, 2014 - C-131/12, GRUR 2014, 895 para. 28; LG Heidelberg, judgment of March 31, 2023 - 6 S 1/22, juris para. 32). It is not necessary for the defendant to adopt the content of the linked websites as its own, which is why the corresponding considerations of the regional court can be left aside.
29It is also irrelevant that the data protection declaration published on the MN..com website names MN. LLC as the responsible data controller. According to the Regional Court's correct statements in this regard, the defendant cannot release itself from its responsibility arising from the factual circumstances by means of a data protection declaration.
30To the extent that the Higher Regional Court, in an advisory decision submitted by the defendant (decision of February 4, 2022 - 10 W 1024/20, Annex B 5), ultimately denied the defendant's responsibility solely on the grounds that the Federal Court of Justice (judgment of July 27, 2020 - VI ZR 405/18, BGHZ 226, 285 para. 13) had stated that in connection with the activities of the search engine MN., MN. LLC was the responsible party within the meaning of Art. 4 No. 7 GDPR, this is not convincing. As the provision of Section 26 GDPR shows, the responsibility of MN. LLC does not exclude the defendant from also being responsible within the meaning of Article 4 No. 7 GDPR (cf. LG Munich, judgment of March 22, 2023 - 26 O 1037/21, MMR 2023, 602, para. 29; LG Heidelberg, judgment of March 31, 2023 - 6 S 1/22, juris, para. 32).
31ff) The plaintiff's personal data are processed unlawfully (Article 17, paragraph 1, letter d GDPR) and the processing is not necessary for the exercise of the right to freedom of expression and information (Article 17, paragraph 3, letter a GDPR). The overall balancing of the conflicting fundamental rights required in this respect, namely the plaintiff's fundamental rights to respect for private life (Article 7 of the Charter) and to protection of personal data (Article 8 of the Charter), as well as the defendant's right to freedom of enterprise (Article 16 of the Charter), the content providers' right to freedom of expression (Article 11 of the Charter) and the users' interests in information (cf. BGH, judgments of July 27, 2020 - VI ZR 405/18, BGHZ 226, 285 para. 20 ff.; of May 3, 2022 - VI ZR 832/20, GRUR 2022, 1009 para. 14 ff.), is in the plaintiff's favor. This is because the article of 00.00. 2019 contains at least one piece of information that is important for the overall understanding of the article, which is actually untrue and which the plaintiff does not have to accept (see ECJ, judgment of December 8, 2022 - C-460/20, GRUR 2023, 184 para. 65; BGH, order of July 27, 2020 - VI ZR 476/18, GRUR 2020, 1338 para. 24; judgment of May 23, 2023 - VI ZR 476/18, BGHZ 237, 137 para. 32).
32(1) According to the case law of the European Court of Justice, the person requesting delisting due to the inaccuracy of a listed content is obliged to prove that the information contained in that content is manifestly inaccurate or at least that a part of that information that is not insignificant for that entire content is manifestly inaccurate. However, in order to avoid an excessive burden being imposed on that person which could undermine the practical effectiveness of the right to delisting, he or she must only provide the evidence which, taking into account the circumstances of the individual case, can reasonably be required of him or her to establish this obvious inaccuracy (see ECJ, judgment of 8 December 2022 - C-460/20, GRUR 2023, 184 para. 68; BGH, judgment of 23 May 2023 - VI ZR 476/18, BGHZ 237, 137 para. 33 et seq.).
33When examining the conditions for the application of Article 17(3)(a) GDPR, the operator of the search engine is not obliged to actively cooperate in the search for facts which are not supported by the delisting request in order to determine whether this request is valid. Therefore, when processing such an application, the operator of the search engine is not obliged to establish the facts of the case and to conduct an adversarial correspondence with the content provider aimed at obtaining missing information on the accuracy of the listed content. Since such an obligation would force the operator of the search engine to make a contribution to proving the accuracy or inaccuracy of the listed content, it would result in a burden on this operator that goes beyond what can reasonably be expected of him in view of his area of responsibility, his powers and his possibilities (see ECJ, judgment of 8 December 2022 - C-460/20, GRUR 2023, 184 para. 70 et seq.).
34Consequently, if the person requesting delisting provides relevant and sufficient evidence to support his or her request and to demonstrate that the information contained in the listed content is manifestly inaccurate or at least a part of that information that is not insignificant for that entire content is manifestly inaccurate, the operator of the search engine is obliged to grant that delisting request (see ECJ, judgment of 8 December 2022 - C-460/20, GRUR 2023, 184 para. 72).
35If the information in question can contribute to a debate of general interest, particular importance must be attached to the right to freedom of expression and information, taking into account all the circumstances of the individual case. In addition, a delisting of articles with the result that it would be difficult to access all of these articles on the Internet would be disproportionate even if only certain information, which is of minor importance in view of the overall content of these articles, turns out to be incorrect (see ECJ, judgment of December 8, 2022 - C-460/20, GRUR 2023, 184 paras. 73 et seq.).
36(2) In view of this, in the case in dispute, the plaintiff has provided the evidence incumbent upon him through his submissions in the statement of claim.
37He has shown that the claim made in the article of 00.00. 2019 that he was wearing a T. patch on his uniform in a picture he posted on his blog and shown next to the article is obviously not true. By submitting two photographs of the badge he wore (Exhibit K 3) and by submitting two internet printouts (Exhibits K 4 and 5), the plaintiff has proven that the badge he wore corresponds to a logo used by the Bundeswehr Logistics School (Exhibit K 4) and - as is already clearly visible at first glance when looking at Exhibits K 3 to 5 - is very different from the club emblem of Y. TR. (Exhibit K 5). The fact that the photograph submitted as Exhibit K 3 shows the same badge that the plaintiff wore in the photo displayed in the article dated 00/00/2019 is also sufficiently recognizable when the displayed photo is enlarged, which is easily possible for the defendant and the Senate and does not place an unreasonable burden on the defendant. Insofar as the Senate described the photo as ambiguous in the oral hearing, this did not refer to the alleged patch of T., but only to the alleged DR. order, as the Senate stated from the outset and clarified again in response to the objection of the defendant's attorney during the hearing.
38Contrary to the defendant's opinion, the false claim is not value-neutral. The plaintiff does not deny being a member of T., which is presented in the article dated 00.00. 2019 as a ""Quote has been removed"". However, the contested false claim contains a criticism of the plaintiff that goes beyond the accusation of membership in a militaristic association. The contested false claim accuses the plaintiff of having publicly identified himself as a member of the association even when carrying out his duties as N. and when wearing a uniform, which is why he must ""Quote has been removed"". Such an accusation is significantly more serious.
39The false claim that the plaintiff was wearing a T. patch in the photo is also not an entirely insignificant part of the article dated 00.00. 2019. The article does contain a large amount of other information and the plaintiff is not the only politician who is presented in the article. However, the introduction of his person is at least as important to the overall content of the article as the introduction of the other persons, especially since the statements concerning the plaintiff come second and only two other politicians are shown in the picture. In addition, the plaintiff only requests delisting to the extent that users of the search engine enter search terms that contain at least his surname. For these users, the introduction of the plaintiff will typically be of greater importance than the introduction of the other politicians. Finally, the false claim regarding the alleged wearing of a T. patch is not only of minor importance in relation to the other statements concerning the plaintiff. This follows from the fact that the false claim in question is to be substantiated by the photo showing the plaintiff. In addition, as explained, the accusation against the plaintiff that he identified himself as a member of a militaristic association while performing his duties as an OM is of considerable significance.
40Furthermore, contrary to the defendant's opinion, the balancing of interests does not work in its favor because it would be possible and reasonable for the plaintiff to successfully take action against those persons who are directly responsible for the publication of the article dated 00.00. 2019 - without significant measures and expenditure of time. In any case, the defendant, who has the burden of explanation and proof for this - possible - objection (cf. BGH, judgment of May 3, 2022 - VI ZR 832/20, GRUR 2022, 1009 para. 56), has not presented sufficient evidence on this matter. According to the plaintiff's unrefuted statement, he could not reasonably be expected to call on other responsible parties because the Antifaschistische Aktion behind the two websites in question and the persons acting on its behalf are not tangible and the registrars of the two domains are based abroad.
41Contrary to the defendant's opinion, the plaintiff's request for delisting is not ultimately precluded by the fact that, according to the plaintiff's request, the defendant should not display the article from 00.00. 2019 if the plaintiff's name is simply entered (see ECJ, judgment of May 13, 2014 - C-131/12, GRUR 2014, 895 para. 80), but only if additional search terms - reproduced in the request - are entered. In this respect, the plaintiff rightly asserted that it cannot be assumed that the respective user already knows the illegal third-party content and is specifically looking for it based on the entry of the additional search terms.
42Since the request for delisting is justified solely on the basis of the false claim that the plaintiff was wearing a T. patch in the photo, the plaintiff's attacks on other content in the article from 00.00. 2019 does not apply.
43b) The injunction asserted with the application under 1 a follows from Section 97 Paragraph 1 Sentence 1 of the Copyright Act.
44The photograph shown next to the article dated 00.00. 2019 is protected by copyright in any case under Section 72 Paragraph 1 of the Copyright Act. According to Section 72 Paragraph 2 of the Copyright Act, the right initially belonged to the plaintiff's wife as the photographer, since the wife took the picture according to the unchallenged factual findings of the regional court, which provide evidence for the oral submissions of the parties (Section 314 Sentence 1 of the Code of Civil Procedure). The fact that, according to the plaintiff, the photo was taken in the area of his workplace does not in any way rule out the possibility that the wife took the picture. By contract dated March 15, 2021, the wife, as the rights holder, granted the plaintiff the exclusive, temporally, spatially and content-wise unlimited right to use the photograph comprehensively, which is why the plaintiff is now actively authorized. There is no evidence whatsoever that the wife had transferred rights to the image to third parties before concluding the contract.
45By showing its users hyperlinks to the two websites reproduced in the application on which the photograph is published, the defendant violates an unnamed exclusive right of the plaintiff to publicly reproduce the photograph (Section 15 (2) of the Copyright Act). The provision of a hyperlink is only to be regarded as a public communication if the person concerned knew or should have known that the link he had set would provide access to a work published on the Internet without authorization, for example because he had been previously informed of this by the copyright holder (see BGH, judgment of September 21, 2017 - I ZR 11/16, GRUR 2018, 178, paras. 55, 67).
46However, such a notice was given in the case in dispute with the pre-trial warnings and the statement in the statement of claim. In particular, by submitting the written contract dated March 15, 2021, the plaintiff has sufficiently proven that his wife took the picture and that she granted the plaintiff comprehensive rights of use. The fact that the agreement did not include the original picture, but apparently only a screenshot of the infringement pattern, does not change this.
47The public reproduction of the photo is also not permissible under Section 51 sentence 1 of the Copyright Act - as the defendant was and is able to convince itself of without a detailed legal examination (cf. ECJ, judgment of June 22, 2021 - C-682/18 et al., GRUR 2021, 1054, para. 116). According to this provision, the public reproduction of a published work for the purpose of quotation is permissible provided that the extent of the use is justified by the specific purpose. Such a justification is obviously ruled out in the case in dispute. The purpose of using the photo in this case was that it served as evidence for the author of the article of 00.00. 2019 for his claims that the plaintiff wore a patch of the T. - a militarist association - and a badge of the DR. Order - a strange Templar order - on his uniform. The first allegation is - as explained - a false allegation, the untruth of which the plaintiff has proven to the defendant. The photo is not suitable to prove the second allegation because the badge in question is not sufficiently clearly visible in the photo; the defendant itself assumes this. Under these circumstances, there is no doubt that the author of the article's right to freedom of expression must give way to the plaintiff's right to intellectual property.
48The same applies to the extent that the defendant invoked Section 50 of the Copyright Act for the first time in the oral hearing. The necessary balancing of the fundamental rights affected in this respect (cf. BGH, judgment of April 30, 2020 - I ZR 228/15, GRUR 2020, 859 para. 48) is to the detriment of the defendant for the reasons stated above in relation to Section 51 of the Copyright Act. Nothing else follows from the decisions of the Hamburg Regional Court (decision of February 21, 2023 - 308 O 2/23) and the Hanseatic Higher Regional Court (decision of August 4, 2023 - 5 W 3/23) submitted as Annex BB2, because in the case decided by these courts, a false allegation was not at issue.
493. The procedural ancillary decisions follow from Section 92 Para. 2 No. 1, Section 709, Section 890 Para. 2 ZPO. Contrary to the defendant's opinion, which is not explained in more detail, the requirements for the admission of the appeal (Section 543 Para. 2 Sentence 1 ZPO) are not met.
504. The defendant's non-supplementary written submission of June 26, 2024 was submitted. For the reasons stated above, the statements contained therein do not give rise to a different decision or to reopening the oral hearing (Section 156 of the Code of Civil Procedure).
51Amount in dispute in the appeal proceedings: €16,000