OLG Schleswig - 17 U 2/24

OLG Schleswig - 17 U 2/24
Court:	OLG Schleswig (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(f) GDPR Article 82(1) GDPR § 1004 Abs. 1 BGB § 31 BDSG § 823 Abs. 1 S. 1 BGB
Decided:	22.11.2024
Published:
Parties:
National Case Number/Name:	17 U 2/24
European Case Law Identifier:	ECLI:DE:OLGSH:2024:1122.17U2.24.00
Appeal from:	LG Kiel (Germany) 17 O 130/23
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Landesvorschriften und Landesrechtsprechung Schleswig-Holstein (in German)
Initial Contributor:	la

A court held that a debt collecting agency's notification to a credit rating agency about a data subject's outstanding payments was unlawful because the claims were already statute-barred.

English Summary

Facts

The data subject had an electricity contract with an electricity provider.

The electricity provider’s terms and conditions included the following paragraph:

“For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.”

The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee.

In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services.

In 2019, the electricity company conveyed the claim to the controller.

In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency.

In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid.

The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well.

Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance.

The controller refused to remove the information from Schufa.

Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR.

Both the controller and the data subject appealed the decision to the Higher Regional Court Schleswig (Oberlandesgericht Schleswig – OLG Schleswig).

Holding

The OLG Schleswig held that the data subject had no right to non-material damages but upheld the LG Kiel judgement insofar as it had ordered the controller to withdraw the information from Schufa.

Unlawfulness of the data transfer due to lack of legitimate interest

The unlawfulness of the notification by the controller to Schufa followed from the fact that the interest of the data subject outweighed the legitimate interest of the controller. The only possible legal basis for the processing was Article 6(1)(f) GDPR. Generally, there was a legitimate interest of Schufa users and the public for the transfer of data about missed payments. The special provision for scoring agencies in § 31 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) could only indirectly provide criteria for the balancing under Article 6(1)(f) GDPR.

Thus, the fact that one of the alternative criteria for the lawfulness of scoring is fulfilled cannot in itself constitute a prevailing legitimate interest. On the other hand, it cannot be necessarily argued that there was a strict limitation to the criteria from § 31 BDSG. Hence, the court left the possibility for cases other than § 31 BDSG that could constitute a prevailing legitimate interest for a notification to the credit rating agency.

However, in this case, the court stuck to the criteria of § 31 BDSG and found that none of these were matched. The court already doubted the legitimacy of some of the claims.

Concerning § 31(2)(5) BDSG that provides that data about unpaid claims may be used for scoring if they allow the claimant to terminate the contract without a deadline, the court held, that this would only apply to the original claim itself, not to alleged further damages. Furthermore, the court found that it could not properly tell both apart in this case due to the opaque information provided by the controller. Thus, the court found that the transfer to Schufa could not even be partially based on § 31(2)(5) BDSG.

Furthermore, it referred to sentence 3 of Recital 47 which provides that at any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.

Because the claims of the controller objectively fell under the statute of limitations already when the controller forwarded them to Schufa for the first time the court held that the data subject did not need to reasonably expect a transfer of data concerning these claims, even though the data subject had not yet invoked the statute of limitations. Therefore, the court held, there was no legitimate interest in this case.

Order to withdraw

While explicitly not deciding if an injunctive relief (Unterlassungsanspruch) could be based on the GDPR directly, the court argued that the GDPR does not prohibit to use other legal basis for an injunctive relief from national law because the GDPR did not have a blocking effect on domestic law due to its aim of broad protection of personal data. Only the complementary application of domestic law ensured that this aim was reached. In this case, the right to obtain an injunctive relief followed from an analogy of § 1004(1) and § 823(1) of the German Civil Code (Bürgerliches Gesetzbuch – BGB) in conjunction with Article 6(1) GDPR.

No non-material damages

However, there was no right for non-material damages under Article 82(1) GDPR because, despite the GDPR infringement, the data subject was not able to show a concrete non-material damage apart from the mere loss of control.

The court allowed an appeal to the German Federal Court of Justice (Bundesgerichtshof – BGH).

Comment

A few days before this judgement was delivered, the BGH had already decided that a loss of control over personal data in itself amounts to a non-material damage. The BGH might change this decision provided the data subject chooses to appeal.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Reporting outstanding debts to credit agencies

Principle

1. The legality of reporting outstanding debts to a credit agency (here: SCHUFA) is determined in principle by Art. 6 GDPR. The criteria contained in Section 31 BDSG for the admissibility of scoring are, however, of indicative significance in this respect.
2. Even a transmission of data to the credit agency that is in principle lawful according to the standard of Section 31 Paragraph 2 Sentence 1 No. 5 BDSG when the underlying contractual relationship can be terminated may only concern those due and outstanding debts that, in the event of arrears, can lead to the underlying contractual relationship being terminated without notice. In the case of arrears with advance payments, this also includes the settled balance, as this only represents a circumstantial and time-related development of the payment claim.
3. However, secondary claims such as "reminder fees", "damages for non-performance", "transfer fees" or "default costs" are not included. The arrears with such secondary claims that depend on the existence of the main claim do not allow any conclusions to be drawn about the debtor's lack of ability to pay or unwillingness to pay.

4. If, after the claims have been presented, such secondary claims and the main claim cannot be clearly separated from one another, the entire registration is unlawful. +

Hide course of proceedingsProcedures
previous LG Kiel, January 9, 2024, 17 O 130/23, judgment
Tenor

On the defendant's appeal - with its rejection in all other respects - the judgment of the Kiel Regional Court of January 9, 2024 - 17 O 130/23 - is amended to the effect that the claim with regard to the compensation for pain and suffering awarded therein under item 2, together with the interest due thereon, is dismissed.

The plaintiff shall bear two thirds of the costs of the appeal proceedings and the defendant one third.

The judgment is provisionally enforceable. The respective debtor can avert enforcement against himself by providing security in the amount of 110 percent of the amount enforceable against him on the basis of the judgment, unless the respective creditor provides security in the amount of 110 percent of the amount to be enforced before enforcement.

The appeal is allowed.

Reasons

I.

Margin number 1

In the action served on July 17, 2023, the plaintiff sought in the first instance the deletion of an entry at Schufa Holding AG (hereinafter: Schufa), the determination that the entry was unlawful, the conviction that a correction of the score value there must be made by means of a notification to Schufa, as well as the future omission of notification of claims for a specific claim account number and non-material damages.

Paragraph 2

In the appeal court – after the first instance dismissal of the action has otherwise become final – the request for deletion and the defendant's obligation to pay non-material damages and extrajudicial legal costs are still in dispute.

Paragraph 3

The plaintiff obtained electricity from A.-Energie GmbH (hereinafter: A. GmbH) between April 1 and September 18, 2014. In a letter dated October 11, 2014 (Appendix B1), A. GmbH invoiced the plaintiff for an amount of €529.16 as part of a final invoice. According to the invoice, this amount includes "proportionate package consumption", reminder fee, damages for non-performance, transfer fee and a "contract account balance". The plaintiff's advance payments of €79.00 on June 4, 2014 and €50.00 on August 6, 2014 were taken into account.

Marginal number 4

For the details of the invoice, reference is made to Appendix B1. The receipt of the invoice by the plaintiff is disputed.

Marginal number 5

The contractual relationship between the plaintiff and A. GmbH, which began on April 1, 2014, had previously been terminated without notice by A. GmbH on September 18, 2014 due to the plaintiff's default in payment. The plaintiff was in arrears with installments.

Marginal number 6

The following regulation can be found in the general terms and conditions of A. GmbH:

Marginal number 7

“For the purpose of checking creditworthiness, the energy supplier can obtain information from credit agencies and pass on to them personal data of the customer relating to the energy supply contract under the conditions of Section 28a BDSG.”

Marginal number 8

Paragraph 4, Section 2 of the general terms and conditions states:

Marginal number 9

“The parties are also entitled to terminate the contract for good cause without observing a period of notice in accordance with Section 314 BGB.”

Marginal number 10

For further details, reference is made to the general terms and conditions, which were submitted in full to the file during the oral hearing before the Senate (pages 116 ff. of the EA. 2nd instance).

Marginal number 11

In a letter dated November 27, 2014 (Appendix B6), B. Inkasso GmbH requested the plaintiff to pay an outstanding claim in the name of A. GmbH in the amount of EUR 658.57. In a letter dated November 29, 2014 (Appendix B7), the plaintiff informed A. GmbH that he had received neither an invoice nor reminders. Irrespective of this, he rejected the claim in the amount of EUR 529.16 as "excessive and excessive". The plaintiff requested that a corrected invoice be sent.

Marginal number 12

According to the letters dated December 15, 2014, May 31, 2017 and December 12, 2017, B. Inkasso GmbH requested the plaintiff to pay the outstanding claim. The sending of these reminders and their receipt by the plaintiff are disputed.

Marginal number 13

The plaintiff had undergone private insolvency proceedings. The plaintiff's period of good conduct ended with the granting of the residual debt discharge on September 26, 2018. The disputed claim was not covered by the residual debt discharge because it only arose in 2014, but the period of good conduct had already begun in 2012.

Paragraph 14

The defendant, a debt collection company, has been the owner of the claim since November 25, 2019, following the assignment.

Paragraph 15

In 2019, the plaintiff did not comply with his request to provide a statement of assets in another matter.

Paragraph 16

By letters dated January 27, 2020 (Appendix B2), April 10, 2020 (Appendix K2) and February 15, 2021 (Appendix B2), the defendant requested the plaintiff to pay and, in each case, indicated with an enclosed information overview that the claims could be transmitted to Schufa (so-called registration notification). The receipt of these letters by the plaintiff is disputed.

Margin number 17

In June 2020, the plaintiff provided a statement of assets in another matter.

Margin number 18

On March 12, 2021, the defendant arranged for the disputed claim to be included as a negative entry in the Schufa database. The negative report affected the score value determined by Schufa; according to information from Schufa dated October 18, 2023 (K14), the score value was 20.22. On March 18, 2022, a routine annual report was made with regard to the disputed claim.

Margin number 19

In a letter dated June 27, 2022 (Appendix K13), C.-Versicherungen VVaG refused to take out legal protection insurance, citing the plaintiff's creditworthiness.

Marginal number 20

On September 23, 2022 (Appendix K7), the defendant requested the plaintiff to pay the outstanding claim in the amount of €828.61 and pointed out in an enclosed information overview that it might report this to Schufa.

Marginal number 21

The defendant then raised the statute of limitations defense in a letter dated October 11, 2022 (Appendix K10). He had previously requested a list of claims in a letter dated October 1, 2022 (Appendix K8), which was sent to him on October 6, 2022 (Appendix K9).

Marginal number 22

In a letter dated October 13, 2022 (Appendix K3), the defendant announced that it would refrain from asserting the claim in the future due to the statute of limitations that had expired. On that day, the statute of limitations defense was registered with Schufa.

Marginal number 23

According to an email dated March 17, 2023 (Appendix K11), D. GmbH rejected a credit request from the plaintiff.

Marginal number 24

The plaintiff's attorney requested the defendant in a letter dated April 17, 2023 (Appendix K4) to arrange for the negative mark to be removed from Schufa. On April 21, 2023 (Appendix K1), the defendant refused to do so.

Marginal number 25

In an email dated May 19, 2023, E. GmbH refused to conclude an internet contract requested by the plaintiff with the following reason: "There was probably a factor that did not allow a contract to be concluded." For further details, please refer to Appendix K12. An email from an insurance company dated October 26, 2023 (Appendix K15) shows that the plaintiff was refused fully comprehensive car insurance due to two "hard" credit hits.

Paragraph 26

The plaintiff claimed that he was not granted a loan due to the negative entry made by the defendant; a telephone contract with Telekom Deutschland GmbH could not be concluded, and it was also not possible to take out legal expenses insurance with the companies F. and G. due to the negative entry. In addition, his general creditworthiness was negatively affected by the negative entry.

Paragraph 27

With regard to the disputed receipt of the defendant's reminders, the plaintiff stated that he operated a post office box in Gettorf at the time. During this period there were other documents that he did not receive.

Paragraph 28

The plaintiff believed that the risk of a negative entry being reported again arose from the fact that the defendant refused to initiate the deletion. In addition, compensation of €5,000 was appropriate.

Margin number 29

The plaintiff has applied for

Margin number 30

1.) to order the defendant to delete the negative entry about the plaintiff contained in the Schufa Holding AG database with the following wording:

Margin number 31

"H. Inkasso GmbH & Co. KG has informed under number 6815500 that there is a payment default and that a settlement account therefore exists

Margin number 32

Information was provided under number 6815500 about a claim amount of 795 euros that was still outstanding as of March 12, 2021.

Marginal number 33

Information was provided about an outstanding claim amount of EUR 817 under the number 6815500 as of March 18, 2022.”

Marginal number 34

to revoke,

Marginal number 35

2.) to determine that the initial registration of the entry with Schufa Holding AG on March 12, 2021 by the defendant was unlawful,

Marginal number 36

3.) to order the defendant to inform Schufa Holding AG that the situation should be restored with regard to the calculation of score values, as if the negative entry of the defendant with Schufa Holding AG on March 12, 2021 referred to under point 1 had not existed,

Marginal number 37

4.) to order the defendant to do so on pain of a fine of up to EUR 250,000 to be imposed for each case of infringement or for the In the event that this cannot be collected, a term of imprisonment of up to six months, to be enforced against the managing director of the defendant, to refrain from informing Schufa Holding AG or another business information service of outstanding claims in connection with the contract for the defendant's account number 6815500 as a so-called negative feature of outstanding claims, provided that no new outstanding claims are to be expected,

Margin number 38

5.) to order the defendant to pay the plaintiff appropriate compensation, the amount of which is left to the court's discretion, but at least €5,000 plus interest at a rate of 5 percentage points above the base interest rate since the action was brought,

Margin number 39

6.) to order the defendant to pay the plaintiff €1,295.43 plus interest at a rate of 5 percentage points above the base interest rate since the action was brought.

Paragraph 40

The defendant has requested that

Paragraph 41

the action be dismissed.

Paragraph 42

It claimed that the letters dated October 11, 2014, November 27, 2014, December 15, 2014, May 31, 2017, December 12, 2017, January 27, 2020, April 10, 2020 and February 15, 2021 were received by the plaintiff.

Paragraph 43

The defendant took the view that the registration was lawful. The contractual relationship could have been terminated because the plaintiff had not adequately fulfilled his obligation to pay the installments. The statute of limitations did not prevent the registration. The simple denial of receipt of letters is implausible.

Marginal number 44

The regional court heard the defendant's managing director in person (page 65 et seq. of the EA, 1st instance) and on this basis partially upheld the claim in its judgment - to which reference is made for further details in accordance with Section 540 Paragraph 1 No. 1 of the Code of Civil Procedure.

Marginal number 45

The claim is largely admissible, only the application for a declaratory judgment is inadmissible because there is no interest in a declaratory judgment. Otherwise, the claim is partially justified.

Marginal number 46

The plaintiff has a claim against the defendant to revoke the data transmission to Schufa initiated by the defendant in accordance with Sections 1004 Paragraph 1 Sentence 1, 823 of the German Civil Code in conjunction with Article 6 Paragraph 1 of the GDPR. In particular, an obligation to tolerate does not arise from Article 6 Paragraph 1 Sentence 1 Letter f) of the GDPR. The balancing of interests to be carried out within the framework of this provision has been made more specific by Section 31 Paragraph 2 of the Federal Data Protection Act. However, there is no evidential effect resulting from this, since neither the requirements of Section 31 Paragraph 2 No. 4 of the Federal Data Protection Act nor the requirements of Section 31 Paragraph 2 No. 5 of the Federal Data Protection Act are met. Both the authorization requirement under No. 4 and the authorization requirement under No. 5 require that the debtor has been informed of a possible consideration by a credit agency. However, there is no notification, since there is no evidence that the reminders, which would have included notification of registration, were received. The letter dated September 23, 2022 was received, but only after the negative report to Schufa.

Margin number 47

There are no special circumstances that would justify a data transfer beyond the provisions of the Federal Data Protection Act. On the contrary, the fact that the data was forwarded to Schufa at a time when the statute of limitations had not yet been raised but was obviously to be expected speaks against a legitimate interest of the defendant.

Paragraph 48

The plaintiff has no claim against the defendant under Sections 823 Paragraph 1 and 1004 Paragraph 1 of the German Civil Code to inform Schufa that the situation should be restored with regard to the calculation of score values as if the negative entry had not existed. There is no apparent basis for such an instruction from the defendant to Schufa. A claim to refrain from reporting outstanding claims to Schufa in connection with the contract in question, provided that no new outstanding claims are to be expected, fails due to the lack of a risk of repetition.

Paragraph 49

The plaintiff is entitled to compensation of €500 from the defendant pursuant to Article 82(1) GDPR, without the defendant being able to exonerate itself within the meaning of Section 82(3) GDPR. The plaintiff's non-material damage here lies in the loss of control over his personal data. Even concluding transactions and contracts with little economic value is made more difficult by a poor rating with Schufa. However, the significant negative effects on his credit score claimed by the plaintiff were not explained in more detail. The basic score of 20.22 could by no means be explained exclusively by the entry initiated by the defendant. The corresponding notifications with reference to two "hard credit hits" suggested that the poor credit rating was largely related to other information from Schufa (such as the failure to provide the asset disclosure). The unlawful transmission of the data was nevertheless tainted with a credit rating defect and gave rise to corresponding non-material damage. However, the financial loss of reputation is to be regarded as far less than for a debtor whose creditworthiness is otherwise flawless.

Paragraph 50

The pre-trial legal costs that the plaintiff can claim under Article 82 (1) GDPR are based on a value in dispute of €2,000, since the compensation for pain and suffering was not claimed before the court.

Paragraph 51

The plaintiff initially appealed against the judgment and challenged the first instance judgment insofar as the applications for higher damages and further pre-trial legal costs were rejected. However, he withdrew his appeal in a written submission dated July 4, 2024.

Paragraph 52

The defendant also appealed against the district court's judgment.

Paragraph 53

She complains that the district court wrongly accepted her obligation to revoke. This claim could not have been based on Sections 1004 and 823 of the German Civil Code, since the GDPR constitutes a conclusive set of rules. There is no opening clause that allows recourse to national law, and in particular it does not arise from Article 79 (1) of the GDPR.

Paragraph 54

The registration was also permissible. The regional court took a short-sighted view when assessing that the plaintiff had not received any of the three letters containing a reference to a registration. The plaintiff did not provide any plausible explanation for why he claims not to have received a single one of the numerous reminder letters over a period of around six and a half years. It is also implausible that the plaintiff apparently received all of the defendant's letters that were sent after the registration without any problems. The assumption of abusive conduct is almost inevitable. The district court failed to recognize the principles of prima facie evidence when it came to the question of receipt of letters. The statute of limitations on the claim was irrelevant.

Margin number 55

The district court's ruling also failed to address the requirements of Section 31 Paragraph 2 No. 5 BDSG and the general terms and conditions of A. GmbH. The reference in the general terms and conditions was sufficient to meet the information requirement of Section 31 Paragraph 2 No. 5 BDSG.

Margin number 56

The claim of A. GmbH had already been proven in the first instance by the detailed final invoice dated January 11, 2014. The payment arrears listed on page 2 of the invoice existed, which led to the termination of the electricity supply contract. The plaintiff also did not sufficiently dispute the claims.

Margin number 57

The necessary mere possibility of termination had existed. Warnings or setting deadlines were unnecessary according to §§ 314 para. 2 sentence 2 in conjunction with 323 para. 2 no. 2 BGB. The admissibility of registration according to § 31 para. 2 no. 5 BDSG is also not limited to those payment arrears for which termination without notice is possible. The wording of the provision is based exclusively on the due date of the claims. This is also clear from the justification for the law, because in these cases there is already a significant breach of contract in the area of responsibility of the person affected. With the termination, the final outstanding claims from the contractual relationship are established and made due. The commentary in Kamp (Wolff/Brink, Beck'scher Online-Kommentar, on § 28a BDSG a.F). does not contradict this, but merely makes it clear that other behavior by the person concerned that violates the contract or violates trust and that justifies termination does not justify the filing of outstanding claims. However, if termination is due to arrears, this also has an indicative effect with regard to the person concerned's ability or willingness to pay. In these cases, according to the justification for the law (BT-Drucksache 16/10529, p. 14), the person concerned's legitimate interest in excluding the transmission takes precedence over the companies' legitimate interest in the transmission.

Paragraph 58

A differentiation between the installments leading to the termination and the total outstanding debts resulting from the registration is not compatible with this and the principle of data accuracy; otherwise, in the sense of a "graduated procedure", the additional claims that arise later would have to be reported subsequently.

Paragraph 59

The regional court also wrongly left open whether the data transfer was permissible under Art. 6 para. 1 lit. f) GDPR. The communication of creditworthiness forms the foundation of the German credit system and thus of the functioning of the economy, which implies the necessity. This interest is also not called into question by the fact that the claim may be time-barred. This is because the claim is in fact open and the negative entry to protect commercial transactions is still justified. In contrast, the plaintiff's interests worthy of protection are not apparent.

Paragraph 60

The assumption of non-material damage is not justified. The ECJ ruling referred to by the regional court does not support this assumption. A "loss of control" as in the case decided by the ECJ cannot be assumed. The path of the data can be traced exactly. Furthermore, only Schufa's contractual partners have access and only if a legitimate interest can be proven. It must also be disclosed to whom Schufa has provided which information. Abuse is therefore excluded. In addition, a loss of control in itself cannot be the basis for immaterial damage. Rather, there must be further effects on the person or living conditions. Such effects are not apparent. The regional court rightly considered disadvantages in commercial transactions to be refuted because there is no causality between the report and the alleged damage. The plaintiff's creditworthiness was already so bad due to other debts that the report in question has no independent significance.

Paragraph 61

Ultimately, the regional court was legally wrong in denying the defendant an exemption from liability under Art. 82 (3) GDPR. The defendant is not at fault. It was entitled to rely on the mailings. The usual care required by Art. 82 GDPR was fulfilled with the documented sending of reminder letters and the double recording of returns or undeliverable mailings. It had no knowledge of the creditor's delivery problems.

Paragraph 62

The defendant requests that

Paragraph 63

the judgment of the Kiel Regional Court of January 9, 2024, 17 O 130/23, be amended and the action dismissed.

Paragraph 64

The plaintiff requests that

Paragraph 65

the defendant's appeal be dismissed.

Paragraph 66

With regard to the revocation, he repeats and expands on his previous arguments:

Paragraph 67

He has no secondary burden of proof with regard to the mailings not received. In any case, he has fulfilled this burden anyway. There is no reasonable reason why he should not have raised the statute of limitations defense on the written submissions of January 21, April 10 or February 15. If he had received them, this would have happened in any case. There are still difficulties with delivery.

Paragraph 68

In any case, the existence of the claim is still disputed, which is why the requirements of Section 31 Paragraph 2 No. 5 BDSG have not been explained.

Paragraph 69

A balancing of interests within the meaning of Article 6 Paragraph 1 Letter f, Paragraph 4 GDPR is in favor of the plaintiff because the claim has already been time-barred since the end of 2017 and the negative feature was only initiated on March 12, 2021, in knowledge that the limitation period had occurred.

Paragraph 70

In any case, there is a claim for damages in the amount of €500.00. He, the plaintiff, is still massively affected by the negative entry. The serious violations of personal rights justify non-material damages at least in the amount awarded. There is undoubtedly a causality between the registration and the massive impairments. According to the information obtained on October 18, 2023, there were no negative entries at that time except for the defendant's entry.

Paragraph 71

Furthermore, reference is made to the written submissions exchanged between the parties, the respective annexes and the minutes of the oral hearing before the Senate on May 31, 2024, during which the plaintiff was heard in person, as well as the minutes of the oral hearings on September 13, 2024 and October 18, 2024 and the Senate's advisory decision announced on June 28, 2024.

II.

Margin number 72

The defendant's appeal is admissible; however, it is only successful with regard to the compensation for pain and suffering awarded to the plaintiff by the regional court.

Margin number 73

The regional court rightly ordered the defendant to revoke the negative entry in the Schufa that it had caused and to pay out-of-court legal costs of €280.60 plus interest of five percentage points above the base interest rate. However, with regard to the compensation for pain and suffering awarded by the regional court of €500, the judgment had to be amended because the plaintiff is not entitled to compensation for pain and suffering.

1.

Margin number 74

The plaintiff can demand that the defendant revoke the negative entry in the Schufa in accordance with Sections 1004 (1), 823 (1) of the German Civil Code in conjunction with Article 6 (1) of the GDPR. According to the Senate's findings, the Schufa entry initiated by the defendant is still there - contrary to the parties' interim assumptions.

Paragraph 75

a) The Senate leaves open whether the GDPR itself contains its own right to injunctive relief or remedy (see aa) below), because the GDPR does not prevent the application of national law (see bb) below).

Paragraph 76

aa) Whether the GDPR contains its own right to injunctive relief and remedy is controversial and has not yet been clarified by the highest court. In some cases, such a claim is derived from Art. 17 GDPR (see, for example, LG Frankfurt/Main, judgment of June 28, 2019 - 2-03 O 315/17, juris, para. 43 ff.; OLG Frankfurt/Main, judgment of March 30, 2023 - 16 U 22/22 -, juris, para. 52), and in some cases also from Art. 17 GDPR in conjunction with Art. 79 GDPR (see BGH, judgment of October 12, 2021 - VI ZR 489/19 -, juris, para. 10 ff.; OLG Frankfurt a.M., judgment of April 14, 2022 - 3 U 21/20 -, juris, para. 28 ff.). In its decision of September 26, 2023 - VI ZR 97/22 - (juris), the Federal Court of Justice referred the question to the European Court of Justice as to whether the data subject is entitled to a claim against the controller who has unlawfully forwarded the data to refrain from further unlawful forwarding of the data. This also concerns the question of the extent to which such a claim arises from the GDPR or whether national law can be used. The case before the European Court of Justice under file number C-655/23 has not yet been decided.

Paragraph 77

The probably overwhelming view in case law and literature assumes corresponding claims for removal/injunction. Only the dogmatic approach is different (see Leibold/Laoutoumai, Injunction under the GDPR?, ZD-Aktuell 2021, 05583 for the current state of opinion).

Marginal number 78

bb) The application of Sections 1004 and 823 of the German Civil Code is not excluded by the GDPR.

Marginal number 79

In case law, the applicability of Section 1004 of the German Civil Code has been denied in isolated cases on the grounds that the GDPR has conclusive effect. The Administrative Court of Regensburg (decision of August 6, 2020, - RN 9 K 19.1061 -, juris, marginal no. 19 et seq.) and the Regional Court of Wiesbaden (judgment of January 20, 2022 - 10 O 14/21 -, CR 2022, 591-593, 592) are of the opinion that Article 79(1) of the GDPR excludes further judicial remedies; in case of doubt, the GDPR should be interpreted restrictively. It is fully harmonized Community law with a conclusive system of sanctions; national injunctions would therefore violate Union law (LG Wiesbaden, loc. cit.).

Paragraph 80

This is not convincing from the Senate's point of view. The GDPR fundamentally aims to provide comprehensive protection with regard to the processing of personal data of natural persons. A blocking effect would run counter to this aim (OLG Dresden, judgment of December 14, 2021 - 4 U 1278/21 -, juris, para. 46) and would only guarantee the protection of personal rights outside the GDPR. In addition, subjective rights for those affected are also provided for outside Chapter III of the GDPR, such as in Art. 82 GDPR (see also Quaas in BeckOK Datenschutzrecht, Wolff/Brink/v. Ungern-Sternberg, 47th Ed., Art. 82 GDPR para. 9 et seq.; see also Halder/Walker in ZD 2020, 605 for the current opinion). Only through the supplementary application of national law can complete legal protection with regard to the processing of personal data of natural persons be guaranteed. Accordingly, the Senate has already assumed in its "Schufa" decision of July 2, 2021 (- 17 U 15/21 -, juris, marginal no. 70) that Section 1004 of the German Civil Code (BGB) is applicable (analogously) in addition to the right to erasure under Article 17 of the GDPR. The LG Lüneburg (judgment of July 14, 2020 - 9 O 145/19 -, juris, marginal no. 29) and the OLG Sachsen-Anhalt (judgment of March 10, 2021 - 5 U 182/20 -, juris, marginal no. 28) also base the claim for injunctive relief or removal on Sections 1004 and 823 of the German Civil Code in conjunction with Article 6 (1) of the GDPR. The route of complaining to the supervisory authority – Art. 77 GDPR – which is sometimes considered sufficient (cf. VG Regensburg, op. cit.), does not ensure adequate legal protection.

Paragraph 81

b) The filing of the disputed claims by the defendant with Schufa was unlawful and gives rise to a claim for removal and injunctive relief by the plaintiff against the defendant in such a way that the unlawful transmission of the data to Schufa must be revoked. This is because the filing of the disputed claim with Schufa proves to be unlawful within the meaning of Art. 6 Para. 1 GDPR, which is directly applicable as secondary Community law (see also Section 1 Para. 5 BDSG). In the absence of the plaintiff's consent, only Art. 6 Para. 1 lit. f GDPR can be considered as the legal basis for the transmission of the data to Schufa. According to this provision, the processing of personal data - and this is what we are talking about here - is lawful if it is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

Marginal number 82

This provision is a central balancing standard in the GDPR. On the one hand, the legitimate interests behind the intended processing, which must be specified with regard to the constellation, and on the other hand, the data protection interests of those affected, which must also be specified in a constellation-specific manner, must be taken into account (Albers/Veit in BeckOK Datenschutzrecht a.a.O., Art. 6 Rn. 63). The term legitimate interests within the meaning of Art. 6 (1) (f) GDPR refers to "the reasonable expectations of the data subject" (Recital 47 GDPR), i.e. all legal, economic or idealistic interests (Senate, judgment of July 2, 2021 - 17 U 15/21 -, juris, para. 51; OVG Lüneburg, decision of January 19, 2021, - 11 LA 16/20 -, juris, paras. 15 and 16 with further references; OLG Sachsen-Anhalt, judgment of March 10, 2021 - 5 U 182/20 -, juris, para. 34).

Paragraph 83

The burden of proof for proving that the processing of data was lawful lies with the defendant.

Marginal number 84

aa) The legality of the data transfer does not arise from the assessments of the BDSG.

Marginal number 85

According to the prevailing opinion - and insofar as there is no dispute between the parties - the requirements of the legitimate interest and the balancing criteria for the conflicting interests of the data subject are specified in Section 31 Para. 2 BDSG, which has adopted Section 28a Para. 1 BDSG a.F. practically word for word, or these provisions can be used as an aid to interpretation when applying Art. 6 GDPR (Albers/Veit a.a.O. Rn. 67, with further references; LG Lüneburg a.a.O., Rn. 31; OLG Sachsen-Anhalt a.a.O. Rn. 36; a.A. Buchner in Kühling/Buchner, DSGVO BDSG, 4th edition 2024, Section 31 BDSG Rn. 4).

Marginal number 86

According to its wording, Section 31 Paragraph 2 of the Federal Data Protection Act refers to the use of a probability value determined by credit agencies regarding the ability and willingness to pay of a natural person. However, information about a due claim that has not been settled in accordance with the contract is relevant to protection in a similar way to the determination of a score value. Score values are also sensitive information about a person that provides information about their ability or willingness to pay (LG Lüneburg, loc. cit.; OLG Sachsen-Anhalt, loc. cit.). In addition, the purpose of Section 31 of the Federal Data Protection Act, which is intended to protect commercial transactions in scoring and creditworthiness reports, and the lack of a separate regulation on the transmission of personal data, mean that the legislator tacitly assumes that only claims that meet the requirements of Section 31 Paragraph 2 of the Federal Data Protection Act are legitimately transmitted and used to determine score values (OLG Sachsen-Anhalt, loc. cit.).

Marginal number 87

Within the framework of Section 31 BDSG, Section 31 Paragraph 2 Sentence 1 No. 4 and No. 5 BDSG come into consideration as justifying circumstances. Both circumstances require the claim to be reported to be due and set out further requirements for the legality of the transmission. It is also of course necessary to provide a plausible explanation of the claim to be reported, because the assertion of this alone does not justify reporting (as rightly stated by Kamp in BeckOK Datenschutzrecht, Wolff/Brink, 14th Ed. on Section 28a BDSG a.F., marginal number 111 with reference to AG Ahlen, judgment of October 8, 2013 - 30 C 219/13 -, ZD 2014, 202 f.)

Marginal number 88

(1) The existence and due date of the disputed claim are already doubtful.

Marginal number 89

The claim filed is a claim from a "final invoice" within the framework of an energy supply contract, which is made up of various items.

Marginal number 90

Insofar as a claim for payment for utility services is asserted, this is based on Section 433 Paragraph 2 of the German Civil Code. A corresponding contractual and utility relationship between the plaintiff and A. GmbH was undisputed. The defendant also stated, without contradiction, that according to Section 4 Paragraph 2 of the general terms and conditions of A. GmbH, the plaintiff was obliged to pay monthly installments of €79, but only paid such an installment once in June 2014 and only made a further payment of €50 on August 6, 2014. At least these arrears were therefore plausible and not simply alleged.

Marginal number 91

In contrast, the final invoice does not only include the electricity charges for 1,306.8 kWh consumed, but 1,543.86 kWh - possibly due to a flat-rate agreement. Despite discussions on this in the oral hearing, the parties did not provide any further information on this.

Marginal number 92

In particular, the final invoice contains not only electricity charges but also other claims that are not readily understandable in themselves and were not explained in more detail by the defendant during the trial. The invoice lists so-called "damages for non-performance" as well as a reminder fee and a transfer fee. In addition, although the two "deductions" paid by the plaintiff in the amount of €79 and €50 are listed, so-called "delay costs" in the amount of €163.47 and €54.37 are offset against them, resulting in a negative balance of -€88.84. In any case, with regard to these invoice items, the Senate has doubts about whether the claim submitted has been adequately presented.

Margin number 93

As far as the due date is concerned, the defendant has also failed to make any relevant submissions, despite the relevant discussion in the oral hearing.

Margin number 94

It remains unclear whether and, if so, which provisions were made in the supply contract regarding the due date of the payment claims. In particular, in the context of supply contracts, the due date may be the receipt of the invoice. In the context of basic supply, the due date would be based on Section 17 StromGVV (formerly Section 27 Paragraph 1 AVBEltV); Section 40c EnWG, which adopted the identical regulation of Section 17 StromGVV, was not yet in force at the time. According to Section 17 Paragraph 1 Sentence 1 StromGVV, invoices and advance payments are due at the time specified by the basic supplier, but no earlier than two weeks after receipt of the payment request. Even if the impression given by the invoice was that this was not a delivery within the framework of basic supply but rather based on a specific tariff, the corresponding applicability of the StromGVV could nevertheless have been agreed - as in numerous other special customer contracts of energy suppliers.

Margin number 95

The defendant did not provide evidence of its claim that the invoice was received by the plaintiff before the registration, but merely cast doubt on the plausibility of the plaintiff's denial. The plaintiff's letter of November 29, 2014, in which he apparently responded directly to the first reminder and stated that he had received neither an invoice nor a reminder (Appendix B7), can in any case be plausibly reconciled with the denial of receipt of the invoice.

Margin number 96

(2) The other requirements of Section 31 Paragraph 2 Sentence 1 No. 4 BDSG are also not fully met, so that this does not provide any indication of the legality of the registration.

Marginal number 97

According to this provision, claims that have not been paid despite being due may be taken into account if, in addition, the debtor has been reminded in writing at least twice after the claim has become due, the first reminder was sent at least four weeks ago, the debtor has previously been informed, but no earlier than the first reminder, of a possible consideration by a credit agency and the debtor has not disputed the claim. At least the latter feature - the lack of dispute of the claim - means that the indicative effect for the legality of the registration according to Section 31 Paragraph 2 Sentence 1 No. 4 BDSG fails.

Marginal number 98

Because the plaintiff had disputed the claim. Any type of objection to the claim, for example the defense of limitation or other objections, is sufficient to dispute it in this sense (see Lapp in Gola/Heckmann General Data Protection Regulation - Federal Data Protection Act, 3rd edition 2022, Section 31 BDSG marginal number 47). Since the standard only refers to the denial as such (in contrast to Section 31 Paragraph 2 Sentence 1 No. 3 BDSG, the addition "expressly" is missing here), no justification is required. However, the denial of the claim must be substantiated. A mere denial without any content is an abuse of law and acts in bad faith towards the contractual partner.

Marginal number 99

Measured against this, the plaintiff's denial is significant within the meaning of the regulation. This is because he had already stated in his letter of November 29, 2014 (B 7) that he had not received an invoice and was rejecting the claim. This was "excessive and excessive" - and therefore the amount was not comprehensible; he requested a corrected invoice. The invoice was therefore not sent again before the registration.

Margin number 100

To the extent that the defendant believes in this context that “on closer inspection” the plaintiff did not dispute the final invoice, which shows the claims exceeding the original payment arrears, but rather disputed A. GmbH’s claims of €529.16 “independently” of the final invoice, this interpretation ignores the fact that the plaintiff also questions the amount of the claim in the letter.

Margin number 101

(3) Not all of the necessary additional requirements are met for the legality of the registration according to Section 31 Paragraph 2 Sentence 1 No. 5 BDSG.

Margin number 102

(a) According to Section 31 Paragraph 2 Sentence 1 No. 5 BDSG, the use of a probability value is permissible if a claim is taken into account whose underlying contractual relationship can be terminated without notice due to payment arrears and for which the debtor has previously been informed of possible consideration by a credit agency.

Marginal number 103

No. 5 therefore covers cases in which the objective conditions exist according to which the contractual relationship underlying the claim can be terminated without notice by the contractual partner of the person concerned due to payment arrears. Since in these cases there is already a significant breach of contract in the area of responsibility of the person concerned, his legitimate interest in excluding the transmission of information about the corresponding claim takes precedence over the legitimate interest of the credit agency. However, this requires that the credit agency has informed the person concerned about the possible consideration of the possibility that the contractual relationship can be terminated without notice (Schaffland/Holthaus in: Schaffland/Wiltfang, General Data Protection Regulation (GDPR)/Federal Data Protection Act (BDSG), 5th edition 2024, Section 31 BDSG 2018, marginal no. 38).

Marginal number 104

(b) However, it is irrelevant here whether A. GmbH was entitled to terminate the contract without notice due to payment arrears and whether the plaintiff had been adequately informed about the conceivable consideration of a possible termination.

Marginal number 105

The - as mentioned - plausible explanation of the plaintiff's not insignificant arrears with his installment payments speaks in favor of a right of termination in accordance with Section 314 of the German Civil Code. The imprecise wording of the reference to the exchange of data with credit agencies contained in the general terms and conditions of A. GmbH and the at least disputed receipt of the defendant's information instructions with letters of demand addressed to the plaintiff dated January 27, 2020 (B 2), April 10, 2020 (K 2) and February 15, 2021 (B 2) speak against adequate information of the plaintiff about the possible registration.

Marginal number 106

(c) The claims registered are in any case not only those on the basis of which the contractual relationship could be terminated without notice.

Marginal number 107

The right to terminate must be linked to the outstanding claim, i.e. to the payment behavior of the person concerned, since otherwise there is no indicative effect with regard to the ability or willingness to pay (cf. Kamp in BeckOK Datenschutzrecht, Wolff/Brink, 14th Ed. on Section 28a BDSG a.F., marginal number 105). This interpretation alone can also be reconciled with the system of Section 31 BDSG. A double reminder (No. 4) is only unnecessary in the context of No. 5 because the person concerned is said to be less in need of protection in the cases of No. 5. If the conditions for termination without notice are met, there is already a significant breach of contract in the area of responsibility of the person concerned, since termination is usually accompanied by a delay in performance over several payment dates (see BT-Drucks. 16/10529, p. 14). Against this background, in the case of No. 5, additional reminders - as required by No. 4 - are considered unnecessary and only for this reason the interest of the person concerned takes a back seat to the interest of the credit agency in transmitting the information on the corresponding claim (see also Schaffland/Holthaus in: Schaffland/Wiltfang, General Data Protection Regulation (GDPR)/Federal Data Protection Act (BDSG), 6th supplementary delivery 2024, Section 31 BDSG 2018, marginal no. 38).

Marginal number 108

In the case in dispute, the defendant was unable to demonstrate this necessary correspondence between the payment arrears justifying termination and the registered claim. It would have been possible to register the advance payments owed by the plaintiff, as well as - subject to the electricity consumption billed being established - register the balance remaining after the final billing, taking into account the advance payments paid. This is because this is merely a time- and circumstance-related development of the actual payment claim on which the advance payments were to be made. However, the other items included in the final bill, such as "reminder fees", "damages for non-performance", "transfer fees" and "default costs", can hardly be items whose non-payment can lead to the contractual relationship being terminated without notice, based on their names alone. Such secondary claims also generally do not allow a reliable conclusion to be drawn about a debtor's lack of ability or willingness to pay, because - especially in the case of a disputed main claim - their existence depends primarily on the fate of the main claim.

Marginal number 109

For the legality of the registration, a distinction must therefore be made between the payment obligations of the person concerned arising from the contractual relationship on the one hand and ancillary claims on the other, which, at least in the present case, cannot be clearly separated from one another according to the documents submitted. This does not mean - as the defendant fears - that there is a "graduated procedure" through subsequent registrations until the final registration, but merely that only claims of the kind that can lead to termination of the contractual relationship may be registered. The defendant would therefore have been required to critically review the scope of the registered claims on its own initiative and reduce them if necessary.

Marginal number 110

Neither the wording of the provision nor the aforementioned legal justification speaks against this view, since it only shows why in the case of Section 31 Paragraph 2 Sentence 1 No. 5 BDSG a "less" compared to No. 4 is sufficient, namely because in these cases there is already a significant breach of contract in the area of responsibility of the person concerned. Finally, if the indicative effect with regard to the ability or willingness of the person concerned to pay is taken into account, this cannot apply to “arbitrary amounts” in the sense of claims that are not readily comprehensible, such as alleged damages due to delay, because in these cases the companies are unlikely to have a legitimate interest in the transmission.

Margin number 111

bb) But even outside the criteria of the BDSG, the balancing of the mutual interests does not result in the legality of the data transmission.

Margin number 112

It does indeed follow from the relationship between the GDPR and the BDSG already mentioned that the criteria of the BDSG must by no means be exhaustive, but can only form the balancing of interests within the framework of Art. 6 Para. 1 GDPR by way of example. It is therefore conceivable – in this respect in line with the defendant’s view – that the legitimate interest of the person concerned can also take precedence over the legitimate interest of the controller in cases other than those mentioned in Section 31 Para. 2 BDSG. However, this is not the case here:

Margin number 113

In principle, both Schufa's contractual partners and the general public have an interest in the provision of creditworthiness information. In general, Schufa's task is to provide its contractual partners with information in order to protect them from losses in consumer credit transactions and at the same time to give them the opportunity to protect their customers from excessive indebtedness by providing advice (cf. OLG Saarbrücken, decision of October 6, 2005 - 8 UH 323/05 -, juris, margin number 31). The Schufa information system serves not only the interests of the credit institutions connected to it, but also the interests of the individual borrower, as the information provided enables loans to be processed quickly and smoothly without formalities and the borrower can be granted loans inexpensively and often even without collateral due to the lower credit risk (BGH, judgment of June 20, 1978 - VI ZR 66/77 -, juris, para. 17). The institution of a credit agency such as Schufa thus serves to enable the credit industry to realistically assess the risk of future lending (BGH, decision of April 12, 2016, - VI ZR 75/14 -, juris, para. 9).

Marginal number 114

This interest of the credit industry is offset by that of the person affected by the transmission of his or her personal data, to decide for themselves which information about him or her is processed by others.

Marginal number 115

The interests mentioned are already taken into account in principle by the provision of Section 31 Paragraph 2 of the Federal Data Protection Act, according to which the data transfer was not lawful. In the present case, there are also no circumstances that would suggest that the data transfer was lawful, despite this indicative effect. Rather, both the statute of limitations that has occurred and the lack of clarity of the individual items reported again speak against an interest in the transmission of the information.

Marginal number 116

With regard to the statute of limitations that the plaintiff also asserted by raising the statute of limitations defense, this follows from Recital 47 of the GDPR. According to Recital 47, sentence 3, the balancing of interests under letter f must include, among other things, examining

Marginal number 117

“whether a data subject can reasonably foresee at the time the data is collected and in view of the circumstances in which it is collected that processing for this purpose may possibly take place. In particular, if personal data are processed in situations in which a data subject cannot reasonably expect further processing, the interests and fundamental rights of the data subject could outweigh the interests of the controller."

Paragraph 118

Admittedly, the statute of limitations had not yet been raised at the time of the notification, so that the claim was still enforceable at that time and, as a result, the interest of the banking industry in informing it about an unfulfilled claim did not have to have lapsed (see OLG Frankfurt/Main, judgment of November 19, 2012 - 23 U 68/12 -, juris, para. 16 ff.; OLG Frankfurt, judgment of March 15, 2023 - 17 U 134/22 -, BeckRS 2023, 13974). Nevertheless, from the point of view of the objectively occurring statute of limitations, it seems doubtful whether the plaintiff still had to expect in 2021 that a claim arising in 2014 would be reported to a credit agency.

Paragraph 119

Another aspect arises against the background of Recital 71 of the GDPR, given the unclear distinction between primary and secondary requirements. Recital 71 states at the beginning of the second paragraph:

Paragraph 120

"In order to ensure fair and transparent processing for the data subject, taking into account the specific circumstances and conditions in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for profiling, implement technical and organizational measures to ensure in an appropriate manner, in particular, that factors leading to inaccurate personal data are corrected and the risk of errors is minimized [...]"

Paragraph 121

The fact that in the final invoice presented here, payment claims from the electricity supply were mixed with other claims in such a way that the existence of the actual payment claim cannot be determined with sufficient certainty can be interpreted as an indication that the defendant did not take sufficient organizational measures to minimize the risk of errors in the data set. In other words: If the defendant does not take sufficient precautions to ensure the accuracy of the data transmitted due to a lack of differentiation according to the type of claims, the interest in data processing cannot be "legitimate" within the meaning of Art. 6 (1) GDPR.

2.

Margin number 122

Contrary to the opinion of the regional court, however, the plaintiff cannot claim compensation for pain and suffering from the defendant.

Margin number 123

a) Art. 82 (1) GDPR can be considered as the basis for the claim. According to Art. 82 (1) GDPR, "any person who has suffered material or immaterial damage as a result of a breach of this Regulation (...) shall have the right to compensation from the controller or the processor". Art. 82 (1) GDPR opens up a direct claim for damages based on tort with a presumption of fault, whereby the controller can provide evidence of exoneration in accordance with paragraph 3.

Marginal number 124

The data transfer to Schufa violated the GDPR because - as already stated in relation to the right of revocation - it was not lawful in accordance with Article 6 (1) GDPR.

Marginal number 125

The defendant has also not exonerated itself in the sense of Article 82 (3) GDPR. It cannot be heard that it had no knowledge of the details of the contractual relationship, that the plaintiff had disputed the claim against A. GmbH. In the context of purchasing the claim for collection, it would have been incumbent on it to inform itself about all the essential processes in connection with the claim. Precisely because the permissible registration with Schufa depends on due date, dispute, notification, etc., it is negligent to register without obtaining knowledge of such relevant circumstances. The same applies to its objection that it was entitled to assume that its reminders with notification had been received.

Marginal number 126

b) However, the plaintiff did not suffer any damage as a result of the violation.

Marginal number 127

In the event of non-material damage, the claim under Article 82 (2) GDPR fulfils a compensatory function and not a punitive function, since the compensation is intended to make it possible to fully compensate for the violation of the regulation (ECJ, judgment of April 11, 2024, C-741/21, NZA 2024, 607). A materiality threshold or de minimis limit does not have to be exceeded (most recently ECJ, judgment of April 11, 2024, C-741/21, NZA 2024, 607 with reference to ECJ, judgment of May 4, 2023, C-300/21, GRUR-RS 2023, 8972; ECJ, judgment of December 14, 2023, C-456/22, GRUR 2024, 150). According to Recital 146, sentence 3 of the GDPR, the concept of damage should be interpreted broadly in a way that fully corresponds to the objectives of the regulation; those affected should be granted a full and effective right to compensation (see also ECJ, judgment of December 14, 2023, C-456/22, GRUR 2024, 150). In principle, the claimant's fear that his data will be misused by third parties in the future due to the violation should be sufficient (ECJ, judgment of December 14, 2023, C-340/21, GRUR-RS 2023, 35786). The data subject may suffer "non-material damage" within the meaning of Art. 82 (1) GDPR due to the temporary loss of control over personal data, which gives rise to a claim for damages, provided that this person can prove that he or she has actually suffered such damage - however minor it may be. On the other hand, the mere violation of the provisions of the GDPR is not sufficient to give rise to a claim for damages on this basis (cf. ECJ, judgment of April 11, 2024, C-741/21, NZA 2024, 607; ECJ December 14, 2023 - C-456/22, loc. cit.).

Paragraph 128

According to these criteria, there is insufficient evidence of non-material damage caused by the unlawful data transfer.

Marginal number 129

The plaintiff considers the impact of the entry made by the defendant on his creditworthiness to be significant: In the eyes of creditors or contractual partners, he is considered insolvent due to this entry, and there are massive impairments in the assessment of his creditworthiness by third parties. He has supported his assessment with correspondence, from which it emerges that various contract initiations apparently failed because of his Schufa credit rating.

Marginal number 130

However, the cases presented by the plaintiff do not show that it was precisely the entry made by the defendant with Schufa that led to the failure of the contracts to be concluded. Rather, the Senate is of the opinion with the Regional Court that neither the low base score of 20.22 resulting from the Schufa report of October 18, 2023 (K14 a.E.) nor the concerns of the plaintiff's potential contractual partners caused by it can be based solely on the defendant's disputed report. The plaintiff's credit score was also - and certainly significantly - influenced by the further circumstances that the plaintiff had previously refused to provide a statement of assets, later provided the statement of assets and went through consumer insolvency proceedings without the defendant being involved in any way. The numerous "conditions request(s) for a credit request" that were made according to Appendix K14 also indicate that the plaintiff's creditworthiness was poor even beyond the negative entry in dispute.

Paragraph 131

The plaintiff rightly points out that no further negative entries emerge from the Schufa report dated October 18, 2023. However, if one takes into account that, for example, a statement of assets submitted is stored by Schufa for three years, the statement of assets submitted by the plaintiff in June 2020 is unlikely to have been deleted until summer 2023, one year earlier the statement of assets refused in 2019. There were therefore further circumstances up to 2023 that significantly impacted the plaintiff's credit rating. The information in Annex K14 is dated October 18, 2023 and only reflects the content available on that date, but does not contain any information about which entries were still available in previous years and were sent to the plaintiff's potential contractual partners.

Paragraph 132

The Senate cannot therefore determine that the unlawful transmission of data by the defendant to Schufa was the reason why 1&1 Telecom GmbH refused to conclude the contracts he was seeking in May 2023 and a motor vehicle insurance company refused to conclude them on October 26, 2023. The further failed contract initiations with I.GmbH and two legal expenses insurance companies alleged by the plaintiff cannot therefore be attributed to the defendant's conduct as the decisive cause. Rather, it is likely that the information on the plaintiff's financial statements - as suggested in the information from an insurance company dated October 26, 2023 (K15) with reference to two "hard" credit score hits - was the deciding factor in the negative decisions of potential contractual partners (see the term "hard" negative characteristics, OLG Saarbrücken, decision of October 6, 2005 - 8 UH 323/05 -, juris, para. 28).

Paragraph 133

Finally, in the present case, there is no risk of loss of control over the plaintiff's personal data. Unlike in the relevant cases in which personal data has reached an unidentifiable and hardly delimitable group of unauthorized persons and the person concerned thereby suffers a loss of control in the sense of helplessness or "being observed", here the recipient of the data, Schufa, is known. The conditions under which information is provided from there are clearly regulated, and it is understandable to whom it is provided. In comparison to other personal data, the unauthorized disclosure of which could be considered as the cause of material or immaterial damage, such as health data, address data, private pictures or emails, the disputed claim data - regardless of the effects on creditworthiness discussed - is of a rather medium sensitivity.

Paragraph 134

Furthermore, a situation such as this, in which unlawful data processing does not simultaneously lead to a claim for compensation for immaterial damage, does not contradict the aim of the GDPR to grant those affected comprehensive legal protection. After all, the determination of illegality or - as here - the conviction to eliminate the consequences by revoking registration with Schufa - can, in addition to eliminating the impairment, also have a compensatory character and be sufficient to guarantee comprehensive legal protection.

3.

Margin number 135

The plaintiff can, however, demand payment of lawyer's fees of €280.60 from the defendant as compensation under Article 82 (1) GDPR. The claim for compensation follows from the unlawful filing of the claim; only then did the involvement of the plaintiff's legal representative become necessary (see Senate, judgment of July 2, 2021, 17 U 15/21, juris, margin number 71). The fees are based on the value of the claim for removal or revocation, since the plaintiff had not claimed compensation for pain and suffering before the court.

Margin number 136

The regional court assessed the value of the claim for removal at €2,000. The Senate has no objections to this - also in view of the withdrawal of the plaintiff's appeal. The amount awarded by the regional court corresponds to the statutory lawyer's fees applicable to this value.

4.

Margin number 137

The decision on costs follows from Sections 97 Paragraph 1, 92 Paragraph 1 ZPO, the decision on provisional enforceability from Sections 708 No. 10, 711, 713 ZPO.

Margin number 138

The appeal was to be allowed in accordance with Section 543 Paragraph 2 ZPO, since the development of the law requires a decision by the appeal court. The question - dealt with by the Senate - of whether, when taking into account the characteristics of Section 31 Paragraph 2 Sentence 1 No. 5 BDSG as part of the balancing of interests in accordance with Article 6 Paragraph 1 GDPR, only those claims may be registered that correspond in nature to the claims justifying termination of the underlying contractual relationship, has not yet been decided by the highest court, but is relevant for a large number of similar cases.