VG Mainz - 1 K 467/19.MZ: Difference between revisions
No edit summary |
|||
(6 intermediate revisions by 5 users not shown) | |||
Line 1: | Line 1: | ||
{ | {{COURTdecisionBOX | ||
|Jurisdiction=Germany | |||
|Court-BG-Color= | |||
|Courtlogo=Courts_logo1.png | |||
|Court_Abbrevation=VG Mainz | |||
|Court_With_Country=VG Mainz (Germany) | |||
|Case_Number_Name=1 K 467/19.MZ | |||
|ECLI=ECLI:DE:VGMAINZ:2020:0220.1K467.19.00 | |||
|Original_Source_Name_1=Landesrecht Rheinland-Pfalz | |||
|Original_Source_Link_1=http://www.landesrecht.rlp.de/jportal/portal/t/51h/page/bsrlpprod.psml;jsessionid=B44E3577658B2ECE6F36ABB73F4AFB30.jp23?doc.hl=1&doc.id=MWRE200001331&documentnumber=1&numberofresults=555&doctyp=juris-r&showdoccase=1&doc.part=L¶mfromHL=true#focuspoint | |||
|Original_Source_Language_1=German | |||
|Original_Source_Language__Code_1=DE | |||
|Original_Source_Name_2= | |||
|Original_Source_Link_2= | |||
|Original_Source_Language_2= | |||
|Original_Source_Language__Code_2= | |||
|Date_Decided=20.02.2020 | |||
|Date_Published= | |||
|Year=2020 | |||
|GDPR_Article_1=Article 4(2) GDPR | |||
|GDPR_Article_Link_1=Article 4 GDPR#2 | |||
|GDPR_Article_2=Article 4(15) GDPR | |||
|GDPR_Article_Link_2=Article 4 GDPR#15 | |||
|GDPR_Article_3=Article 6(1)(a) GDPR | |||
|GDPR_Article_Link_3=Article 6 GDPR#1a | |||
|GDPR_Article_4=Article 6(1)(b) GDPR | |||
|GDPR_Article_Link_4=Article 6 GDPR#1b | |||
|GDPR_Article_5=Article 6(1)(f) GDPR | |||
|GDPR_Article_Link_5=Article 6 GDPR#1f | |||
|GDPR_Article_6=Article 6(4) GDPR | |||
|GDPR_Article_Link_6=Article 6 GDPR#4 | |||
|GDPR_Article_7=Article 7 GDPR | |||
|GDPR_Article_Link_7=Article 7 GDPR | |||
|GDPR_Article_8=Article 9(1) GDPR | |||
|GDPR_Article_Link_8=Article 9 GDPR#1 | |||
|GDPR_Article_9=Article 9(2)(f) GDPR | |||
|GDPR_Article_Link_9=Article 9 GDPR#2f | |||
|GDPR_Article_10=Article 9(2)(h) GDPR | |||
|GDPR_Article_Link_10=Article 9 GDPR#2h | |||
|GDPR_Article_11=Article 28 GDPR | |||
|GDPR_Article_Link_11=Article 28 GDPR | |||
|GDPR_Article_12=Article 58(2)(b) GDPR | |||
|GDPR_Article_Link_12=Article 58 GDPR#2b | |||
|GDPR_Article_13=Article 5(1)(a) GDPR | |||
|GDPR_Article_Link_13=Article 5 GDPR#1a | |||
|GDPR_Article_14= | |||
|GDPR_Article_Link_14= | |||
|EU_Law_Name_1= | |||
|EU_Law_Link_1= | |||
|EU_Law_Name_2= | |||
|EU_Law_Link_2= | |||
|National_Law_Name_1=§ 20 German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) | |||
|National_Law_Link_1=https://dsgvo-gesetz.de/bdsg/20-bdsg/ | |||
|National_Law_Name_2= | |||
|National_Law_Link_2= | |||
|National_Law_Name_3= | |||
|National_Law_Link_3= | |||
|Party_Name_1=Veterinarian (anonymous) | |||
|Party_Link_1= | |||
|Party_Name_2=Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI | |||
|Party_Link_2= | |||
|Party_Name_3= | |||
|Party_Link_3= | |||
|Appeal_From_Body=LFDI (Rhineland-Palatinate) | |||
|Appeal_From_Case_Number_Name= | |||
|Appeal_From_Status= | |||
|Appeal_From_Link= | |||
|Appeal_To_Body= | |||
|Appeal_To_Case_Number_Name= | |||
|Appeal_To_Status= | |||
|Appeal_To_Link= | |||
|Initial_Contributor= | |||
| | |||
}} | |||
| | |||
The Administrative Court of Mainz ruled that the data required for the collection of claims may be transmitted by a veterinarian to a collection agency on the basis of Art 6(1)(b) and (f) GDPR. | The Administrative Court of Mainz ruled that the data required for the collection of claims may be transmitted by a veterinarian to a collection agency on the basis of Art 6(1)(b) and (f) GDPR. | ||
Further, the abstract possibility alone that information on animal treatment contracts may in special cases be used to draw conclusions about the health of the animal owner does not generally make them health data. | |||
==English Summary== | ==English Summary== | ||
===Facts=== | ===Facts=== | ||
The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce | The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce it. The pet owner's data are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. This is done without the (explicit) consent of the pet owner. | ||
After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority ( | After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI) which issued a warning under Article 58(2)(b) GDPR, holding that the data transmission from the plaintiff to the VTX did not meet the requirements under the GDPR. Moreover, the LfDI asked the plaintiff to confirm that in the future, he would transfer data of pet owners to VTX only with their prior consent. | ||
The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate. | The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate. | ||
Line 90: | Line 105: | ||
===Holding=== | ===Holding=== | ||
The Court held that | The Court held that... | ||
* the transmission of a pet owner's data from a veterinarian to the VTX for claim enforcement purposes does not make the VTX a data processor acting on behalf of the veterinarian. This is also the case if the transmission takes place, <u>before</u> the VTX accepts an assignment of claims. The court did not further elaborate the | *... the transmission of a pet owner's data from a veterinarian to the VTX for claim enforcement purposes does not make the VTX a data processor acting on behalf of the veterinarian. This is also the case if the transmission takes place, <u>before</u> the VTX accepts an assignment of claims. The court did not further elaborate the reasons for this holding. | ||
* data of a pet owner that are transferred from a veterinarian to the VTX do not | *... data of a pet owner that are transferred from a veterinarian to the VTX do not constitute health data under Article 4(15) GDPR. The abstract possibility alone that in special cases conclusions about the health of the animal owner can be drawn from information on animal treatment contracts (such as accounting documents) does not yet make them health data. Hence, Article 9 GDPR was not applicable. | ||
* the transmission of a pet owner's data from a veterinarian to the VTX is lawful under Article 6(1)(b) and (f) GDPR. The enforcement of a claim against a pet owner who is in default of payment serves the purpose of the treatment contract | *... the transmission of a pet owner's data from a veterinarian to the VTX is lawful under Article 6(1)(b) and (f) GDPR. The enforcement of a claim against a pet owner who is in default of payment serves the purpose of the treatment contract, namely the pet owner's obligation to pay the veterinarian's fee. Since the assignment of the claim has not changed the purpose of the contract, Article 6(4) GDPR is not relevant. | ||
* this data transfer is also lawful under Article 6(1)(f) GDPR as it is | *... this data transfer is also lawful under Article 6(1)(f) GDPR as it is necessary to protect the veterinarian's legitimate interest in enforcing his contractual claim with the help of third parties. This interest overrides the pet owner's interest who has violated his contractual obligation to pay. | ||
==Comment== | ==Comment== |
Latest revision as of 15:11, 22 March 2022
VG Mainz - 1 K 467/19.MZ | |
---|---|
Court: | VG Mainz (Germany) |
Jurisdiction: | Germany |
Relevant Law: | Article 4(2) GDPR Article 4(15) GDPR Article 6(1)(a) GDPR Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 6(4) GDPR Article 7 GDPR Article 9(1) GDPR Article 9(2)(f) GDPR Article 9(2)(h) GDPR Article 28 GDPR Article 58(2)(b) GDPR Article 5(1)(a) GDPR § 20 German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) |
Decided: | 20.02.2020 |
Published: | |
Parties: | Veterinarian (anonymous) Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI |
National Case Number/Name: | 1 K 467/19.MZ |
European Case Law Identifier: | ECLI:DE:VGMAINZ:2020:0220.1K467.19.00 |
Appeal from: | LFDI (Rhineland-Palatinate) |
Appeal to: | |
Original Language(s): | German |
Original Source: | Landesrecht Rheinland-Pfalz (in German) |
Initial Contributor: | n/a |
The Administrative Court of Mainz ruled that the data required for the collection of claims may be transmitted by a veterinarian to a collection agency on the basis of Art 6(1)(b) and (f) GDPR.
Further, the abstract possibility alone that information on animal treatment contracts may in special cases be used to draw conclusions about the health of the animal owner does not generally make them health data.
English Summary
Facts
The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce it. The pet owner's data are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. This is done without the (explicit) consent of the pet owner.
After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI) which issued a warning under Article 58(2)(b) GDPR, holding that the data transmission from the plaintiff to the VTX did not meet the requirements under the GDPR. Moreover, the LfDI asked the plaintiff to confirm that in the future, he would transfer data of pet owners to VTX only with their prior consent.
The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate.
Dispute
Three disputes werde adressed from a data protection perspective:
- Does the transmission of a pet owner's data for claim enforcement purposes from a veterinarian to the VTX, before the VTX accepts an assignment of claims make the VTX the veterinarian's data processor?
- Do data of a pet owner that are transferred from a veterinarian to the VTX consitute health data under Article 4(15) GDPR, since some diseases could be transmitted from animals to humans or from humans to animals (so-called "zoonoses").
- Is the transmission of a pet owner's data from a veterinarian to the VTX lawful under Article 6(1)(b) and (f) GDPR and Article 6(4) GDPR or does such processing require the pet owner's consent?
Holding
The Court held that...
- ... the transmission of a pet owner's data from a veterinarian to the VTX for claim enforcement purposes does not make the VTX a data processor acting on behalf of the veterinarian. This is also the case if the transmission takes place, before the VTX accepts an assignment of claims. The court did not further elaborate the reasons for this holding.
- ... data of a pet owner that are transferred from a veterinarian to the VTX do not constitute health data under Article 4(15) GDPR. The abstract possibility alone that in special cases conclusions about the health of the animal owner can be drawn from information on animal treatment contracts (such as accounting documents) does not yet make them health data. Hence, Article 9 GDPR was not applicable.
- ... the transmission of a pet owner's data from a veterinarian to the VTX is lawful under Article 6(1)(b) and (f) GDPR. The enforcement of a claim against a pet owner who is in default of payment serves the purpose of the treatment contract, namely the pet owner's obligation to pay the veterinarian's fee. Since the assignment of the claim has not changed the purpose of the contract, Article 6(4) GDPR is not relevant.
- ... this data transfer is also lawful under Article 6(1)(f) GDPR as it is necessary to protect the veterinarian's legitimate interest in enforcing his contractual claim with the help of third parties. This interest overrides the pet owner's interest who has violated his contractual obligation to pay.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the German original for more details.
DECISION Guiding principle 1. the data required for the enforcement of claims may be transmitted by a veterinarian to a collection agency on the basis of Art. 6 para. 1 sentence 1 lit. b DSGVO or Art. 6 para. 1 sentence 1 lit. f DSGVO However, only those data required for the collection of claims may be transmitted to the collection service provider. 2) The abstract possibility alone that information on animal treatment contracts - such as accounting documents - may in special cases be used to draw conclusions about the health of the animal owner does not generally make them health data. Tenor The proceedings shall be closed in so far as the parties have unanimously declared that there is no longer any need to adjudicate on the main action as regards point 2 of the decision of 16 April 2019. In all other respects, the notice of 16 April 2019 (No. 1) is revoked. Orders the defendant to pay the costs. The judgment shall be provisionally enforceable as regards costs. The defendant is not permitted to avert enforcement by providing security in the amount of the respective enforceable amount unless the plaintiff provides security in the same amount beforehand. The appeal is allowed. Facts 1 The plaintiff objects to a warning under data protection law issued by the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate - LfDI -. 2 The plaintiff is a veterinarian and concluded a billing contract and a contract processing agreement with the clearing house for veterinarians - VTX - in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO. According to this directive, the plaintiff can delegate his accounting activities to the association without the express consent of the pet owners who have had their animal treated by the association. Claims of the veterinarian against his patients or the pet owners should be transferred to VTX in accordance with the provisions of the contract if default has occurred and VTX has accepted the transfer. Upon acceptance of the assignment, VTX becomes the owner of the claim. According to the preamble of the Settlement Agreement, VTX shall, prior to the assignment of the receivables, carry out commissioned processing within the meaning of Art. 28 DSGVO, which is further detailed in the Agreement on commissioned processing pursuant to Art. 28 DSGVO. The data of the livestock owners are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. 3 After a pet owner failed to pay a treatment invoice of the plaintiff dated June 5, 2018 for € 1,001.03 on time, the plaintiff cancelled his self-generated invoice and sent it to VTX on July 3, 2018 for collection. The pet owner had not given his consent to this data transfer and filed a complaint with the LfDI after being requested to pay by VTX. 4 After the hearing of the plaintiff, a warning was issued by decision of 16 April 2019 on the basis of Art. 58 para. 2 lit. b DSGVO. The warning (item 1 of the notice) was justified by the fact that the plaintiff had transferred personal data of an animal keeper to the VTX although the data protection requirements for this had not been met. At the same time, the plaintiff was asked to state (item 2 of the decision) whether he would in future observe the provisions of data protection law in comparable cases and only transfer the data of the pet owners to VTX with their prior consent. 5 The plaintiff filed an action on April 30, 2019. With regard to the declaration required of the plaintiff under item 2 of the notice of 16 April 2019, he first submitted that there was no legal basis for it. However, at the hearing, the defendant reversed paragraph 2 of the decision of 16 April 2019, so that the plaintiff declared the legal dispute to be settled in this respect. With regard to the warning regulated in paragraph 1 of the decision, it was questionable whether this was even a contestable administrative act. In any event, the plaintiff had not violated provisions of the Basic Data Protection Regulation, so that the prerequisites for a warning under Article 58.2 lit. b of the DPA Regulation were not met. Since the pet owner had breached his contractual payment obligations, the plaintiff had been entitled to pass on his data to third parties - in this case: VTX - in order to enforce his claim. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as commissioned data processing. No consent is required for the subsequent assignment after the occurrence of the default. The debtor or pet owner did not have to be asked for his consent if he was in breach of contract and did not meet his payment obligations. It was only a question of whether the transmitted data were suitable and necessary for the Commissioner to be able to fulfil his task (principle of purpose limitation). In this way, the plaintiff had in any event transmitted the relevant data of the animal keeper to VTX in an admissible manner pursuant to Article 6.1 letters b and f, paragraph 4 of the DPA. Moreover, the data transfer was also admissible pursuant to Article 9 DSGVO. These were health data within the meaning of Art. 9 para. 1, Art. 4 no. 15 FADN, since some diseases could be transmitted from animals to humans or from humans to animals (so-called "zoonoses"), so that in some cases, conclusions could be drawn about the health of the keeper even in the case of animal diseases. The plaintiff also points out that consent that meets the strict requirements of Art. 7 DSGVO cannot generally be observed in treatment contracts with doctors and is therefore systematically inappropriate. A further argument in favour of data transmission in conformity with data protection is that it is exempt from punishment under § 203 of the German Criminal Code. 6 The applicant claims that the Court should 7 annul the defendant's decision of 16 April 2019 8 The defendant claims that the Court should 9 dismiss the action. 10 The defendant takes the view that the warning was issued lawfully. According to the applicant, the basic data protection regulation was infringed by the applicant's unlawful transfer of data to the VTX. 11 There is no effective contract for the processing of data within the meaning of Article 28 of the DSGVO which could legitimize the processing of data, since VTX became the owner of the claims with the assignment. Nor did the statutory provisions of Article 6 DSGVO apply in the present case. The transfer of data associated with the assignment was not necessary for the performance of a contract within the meaning of Article 6 (1) (b) DSGVO. While the collection of data by the plaintiff was covered by the contractual relationship existing with the patient or pet owner, this did not apply to the transfer of such data to VTX for collection purposes. The original animal treatment contract did not cover these processing aspects. Nor could the plaintiff invoke a legitimate interest within the meaning of Article 6 (1) (f) of the DSGVO that outweighed the fundamental freedoms of the person concerned. A possible breach of contract on the part of the patient or the pet owner did not entitle the data processing to be extended. Furthermore, the data in question are health data within the meaning of Article 9 DSGVO - irrespective of whether, in a specific individual case, conclusions about the owner can be drawn from this information about the animal's illness. The transfer of data in this case was not justified by Article 9 (2) (f) and (h) DSGVO. According to Art. 9 para. 2 lit. f DSGVO, only own data processing in judicial, extrajudicial or administrative proceedings is permissible; however, this does not include the standard assignment and data transfer in debt collection. The transfer of data was also not permissible under Art. 9 para. 2 lit. h DSGVO because this would have required the consent of the patient or the pet owner. With regard to the request under item 2 of the notice of 16 April 2019, the defendant first stated that it was not a legal obligation of the plaintiff to act, but rather an indication with regard to further procedural steps. The plaintiff had been given the opportunity to comment by the invitation in paragraph 2 of the notice. In the oral hearing, the defendant annulled paragraph 2 of the decision and joined the plaintiff's declaration of completion. 12 For further details of the facts and circumstances of the case, reference is made to the defendant's court file and administrative file (1 booklet), which were before the Chamber and were the subject of the hearing. Reasons for the decision 13 Insofar as the parties to the proceedings had unanimously declared the proceedings to be settled with regard to point 2 of the contested decision, the proceedings were to be discontinued by analogous application of § 92 para. 3 of the Administrative Court Rules (Verwaltungsgerichtsordnung - VwGO). 14 The action is admissible as regards the remaining point 1 of the contested decision (I.) and is also successful on the merits (II). 15 I. The action is admissible. 16 Pursuant to § 42, Subsection 1, Var. 1, VwGO, the action for rescission is admissible, since the contested warning is an administrative act - at least a declaratory act - within the meaning of § 35, Sentence 1, Administrative Procedure Act - VwVfG - in conjunction with § 1 of the State Administrative Procedure Act - LVwVfG. Finally, the warning states that the addressee has violated the Basic Data Protection Regulation. It is true that the warning does not trigger any concrete, direct legal obligation. Nevertheless, the warning implicitly expresses that the addressee should act in conformity with data protection in the future. Furthermore, the warning is a remedial measure by the data protection authority, which punishes a - albeit regularly rather minor - breach of data protection (see Körffer, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed. 2018, Art. 58, marginal 18; Selmayr, in: Ehmann/Selmayr, 2nd ed. 2018, Basic Data Protection Regulation, Art. 58, marginal 20). 17 The plaintiff is the addressee of an incriminating administrative act (warning; No. 1 of the notice) and is therefore entitled to bring an action within the meaning of § 42 (2) VwGO. According to § 68.1 sentence 2 no. 1 VwGO, § 20.6 BDSG, preliminary proceedings were unnecessary. The one-month period of § 74.1 sentence 1 VwGO was observed. The Administrative Court of Mainz is, pursuant to § 20 (1) and (3) of the Federal Data Protection Act - BDSG - in conjunction with Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO. 18 II. the action is also well founded. The warning issued in number 1 of the decision of 16 April 2019 must be set aside because it is unlawful and infringes the plaintiff's rights (see § 113.1 sentence 1 of the Rules of the Administrative Courts (VwGO)). 19 Pursuant to Art. 58 para. 2 lit. b) FADP, the supervisory authority may issue a warning if a data-processing body has infringed the Regulation. The lawfulness of data processing is governed by Art. 5 et seq. DSGVO. 20 The plaintiff is a data processor because he has transferred data of an animal keeper to VTX. The data transfer is the processing of data within the meaning of § 4 no. 2 DSGVO. 21 This data processing was carried out here lawfully, so that no complaint can be lodged against Art. 5 para. 1 lit. a) DSGVO. It is true that the data processing in dispute here cannot be regarded as commissioned data processing within the meaning of Article 28 DSGVO (1.). However, the data processing was carried out in a permissible manner on the basis of Art. 6 DSGVO (2.). The increased requirements, which according to Art. 9 DSGVO are made on the processing of special categories of personal data, did not have to be observed in the present case (3.). 22 1. in the present case, the transfer of data of the animal keeper concerned from the plaintiff to the VTX did not take place within the framework of commissioned data processing pursuant to Art. 28 DSGVO The procedure, according to which the transfer of the data from the veterinary surgeon to the clearing and collection agency prior to the assignment of the claim would in principle have to be assessed as commissioned processing, would not only constitute a contract to the detriment of third parties and would constitute a circumvention of the actually relevant, stricter requirements of Art. 6 et seq. DSGVO for a data transfer to a third party not bound by instructions, but above all is in fact not to be assessed as contract processing. 23 The first argument against the assignment of claims and the fact that VTX is bound by instructions is that the assignment - which, according to the plaintiff, causes VTX as the responsible party to switch from processing orders to data processing - is ultimately based on a free decision by VTX (see also the preamble of the settlement agreement): according to the agreement, the assignment of claims necessarily requires a declaration of acceptance by VTX. The far-reaching changes to data protection law intended by the plaintiff, which are to be initiated by the assignment, are thus not under the control of the party responsible. 24 It is true that the applicant may have transferred the data in its possession to the VTX at a time when the assignment was not yet effective. However, the VTX still had access to the data even after the assignment had taken place. It did not process them until after the assignment as the holder of the claim and appeared before the pet owner concerned with its own invoice for the treatment costs. This data processing was not carried out on behalf of the plaintiff because the plaintiff assigned its claims against the pet owner to VTX in accordance with the contract. As assignee, VTX can independently enforce the claim against the pet owner and process the data in its possession independently and without instruction. The plaintiff has no authority to issue instructions to VTX after the assignment has been made on the basis of the contract (see also Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 136; Ziegenhorn/Fokken, ZD 2019, 194). 25 Insofar as the factual requirements of Art. 28 DSGVO are not met, it is irrelevant whether the VTX is to be regarded as a processor under the settlement agreement concluded with the plaintiff at the time of the data transfer. 26 2. the transmission of data of the animal keeper by the plaintiff to the VTX was lawful pursuant to Art. 6(1) sentence 1 lit. b DSGVO (a)) and Art. 6(1) sentence 1 lit. f DSGVO (b)) respectively 27 a) The data transmission, which here took place within the framework of an assignment to TVG as the collection agency, is permissible pursuant to Art. 6 Para. 1 Sentence 1 lit. b DSGVO. 28 On this legal basis, data transmission may be permissible irrespective of the conduct of the data subject - in particular without consent within the meaning of Art. 6 para. 1 sentence 1 lit. a, Art. 7 DSGVO. Finally, the elements of admissibility contained in Art. 6 para. 1 DSGVO are equivalent in terms of their legal function and apply side by side without it being necessary to assume a tiered relationship. It cannot be concluded from the enumeration of the various admissibility elements that consent under Article 6.1 sentence 1 lit. a DSGVO is a prior-ranking admissibility element and that, for example, the general weighing of interests under Article 6.1 sentence 1 lit. f DSGVO must be understood as the ultima ratio. In this respect, the statutory grounds for authorisation take account not only of the data protection interests of the data subjects, but also of the recognisable interests of the controller in data processing that is permissible by way of exception (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Article 6, marginal no. 10). Article 6(1) sentence 1(b) DSGVO allows the controller to process data within the limits of the contract concluded in each case; further protection beyond a weighing of interests is not necessary because the data subject, as a contracting party, has decided to conclude the contract and the associated rights and obligations (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 29; Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. status 1 November 2019, Art. 6, marginal 29). 29 According to Art. 6 para. 1 sentence 1 lit. b DPA, data processing - which is in principle unlawful - is lawful (prohibition subject to authorisation), inter alia, if the processing is necessary for the performance of a contract to which the data subject is a party. In principle, all contracts relating to data processing can be covered by this provision (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal no. 28). 30 The contract, the performance of which is at stake, must have been concluded with the person whose data are processed. It is not necessary that the contractual partner of the data subject and the controller processing the data are the same person. Therefore, on the basis of Art. 6 para. 1 sentence 1 lit. b DSGVO, data processing by uninvolved third parties is also legitimised if it is necessary for the performance of a contract to which the data subject is a party (cf. Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. Status 1 November 2019, Art. 6, marginal no. 30). In the present case, the plaintiff and the pet owner affected by the data processing have concluded a treatment contract for the horses of the pet owner. 31 However, data processing pursuant to Art. 6 para. 1 sentence 1 lit. b DSGVO is only permissible if it is necessary for contractual purposes. This is usually the case if the essentialia negotii of the respective contract are affected. However, no excessively strict requirements are placed on the necessity of data processing: A data processing is not only necessary for the fulfilment of the contract if the contract could not be carried out without the data processing; rather, it is sufficient if the data processing is objectively reasonable with regard to the purpose of the contract (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal no. 38; Albers/Veit, in: Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. status 1 November 2019, Art. 6, marginal no. 32). 32 The main performance obligations of the treatment contract concluded here included the plaintiff's obligation to provide veterinary treatment and the obligation of the pet owner to pay the veterinary surgeon's fee. The pet owner did not comply with this obligation and did not pay the invoice amount of € 1,001.03 within the payment period. The enforcement of this claim serves the purpose of the treatment contract. In doing so, there is no legal objection if the owner of the claim - here: the plaintiff as a veterinarian - assigns the claims to a third party - here: VTX - as a collection agency for the purpose of making the claim management more effective. In accordance with the provisions of the German Civil Code (BGB), the assignment as such does not require the debtor's consent in order to be effective, provided that this does not violate a statutory prohibition pursuant to § 134 BGB. However, the validity of the assignment is not relevant for the question whether an inadmissible data transfer has taken place. 33 The data required for the debt enforcement by the collection agency could be transmitted here. After all, data transfer is a necessary means to an end: the aim is to be able to collect the due claim from the debtor. Without the necessary information, the transferred claim would be useless for the assignee (see Lehmann/Wancke, WM 2019, 613 [615; 618]; Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, margin no. 136; Abel/Djagani, ZD 2017, 114 [117]). However, only those data required for debt collection may be transmitted to the collection service provider. The fact that the plaintiff transferred more data than would have been necessary for the performance of the contract was not accused by the plaintiff and not alleged by the defendant. 34 Since the assignment of the claim has not changed the purpose of the contract, Art. 6 para. 4 DSGVO is not relevant (see Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, margin no. 136; Abel/Djagani, ZD 2017, 114 [117]). Finally, even after the assignment, the main contractual obligation of the animal keeper should be enforced and not new objectives, such as advertising purposes, should be pursued. 35 b) In any case, the data transfer here is (also) lawful under Art. 6 para. 1 sentence 1 lit. f DSGVO. According to this, the processing of data is permissible if this is necessary to safeguard the legitimate interests of the controller or of a third party, provided that the interests or fundamental rights and freedoms of the data subject which require the protection of personal data do not prevail. On this basis, the legitimate interests of the controller must be weighed against the interests of the data subject. 36 The balance of interests is in favour of the plaintiff. The transfer of the data to VTX was necessary here to protect his legitimate interests. As a veterinarian, the plaintiff has a legitimate - legal and economic - interest in his veterinary services being remunerated by the respective animal owners. If a pet owner does not meet his contractual obligation to perform, the veterinarian also has a legitimate interest in enforcing his contractual claim with the help of third parties. This is a normal reaction of the responsible person to the behaviour of a third party in breach of contract (see Wolff, in: Schantz/Wolff, Das neue Datenschutzrecht, 1st ed. 2017, marginal no. 668). 37 Predominant interests of the animal keeper affected by the data transfer do not conflict with this interest of the veterinarian: Finally, the animal keeper has himself contributed to the fact that the data transfer became necessary for the collection of the claim by violating his contractual obligation to pay (see Conrad/Dovas, in: Forgó/Helfrich/Schneider, Betrieblicher Datenschutz, Part IX, Chapter 2, marginal no. 105; Schulz, in: Gola, DSGVO, 2nd ed. (2018), Art. 6, marginal 136). 38 3 Whether the data transfer here is lawful under Art. 9 DSGVO can be left open. The Chamber assumes that the data transmitted here by the plaintiff are not health data within the meaning of Art. 4 No. 15 DSGVO. Accordingly, "health data" are personal data relating to the physical or mental health of a natural person, including the provision of health services, and from which information on his or her state of health can be deduced. 39 The present case concerns 'health data' of the animals treated by the plaintiff under veterinary supervision. The fee invoice that the plaintiff has sent to VTX for collection of the claim also provides information on the health of the animals. However, this is not data relating to the health of a natural person, so it is not specifically protected by the provision in Art. 9 DSGVO. The parties concerned have not submitted that the present case concerned animal diseases that can be transmitted to humans and thus to the affected animal owner and can affect his health, or that diseases were affected that are transmitted from humans to animals (so-called "zoonoses"). The abstract possibility alone that in special cases conclusions about the health of the animal owner can be drawn from information on animal treatment contracts - such as accounting documents - does not yet make them health data (see LG Dortmund, judgement of 9 February 2006 - 4 S 176/05 -, juris, marginal no. 16 ff.; a.A. LG Bochum, judgement of 25 November 1992 - 10 S 42/92 - beck-online). 40 If, on the other hand, information on the debtor - animal owner - has been transmitted because it is relevant for the enforcement of the claim (e.g. name and address), this is not particularly sensitive data under Art. 9 DSGVO. 41 Criminal relevance is irrelevant to the question of whether there is a violation of data protection law that is objectionable. 42 As regards the contested part, the decision on costs is based on Paragraph 154 of the VwGO, and the remainder follows from Paragraph 161(2) of the VwGO. 43 Pursuant to § 161 (2) VwGO, the costs of the proceedings are to be decided by order, taking into account the previous state of affairs and the state of the dispute, at equitable discretion. 44 As a rule, it is equitable discretion to order the costs of the proceedings to be borne by the party which, without settlement, would probably have been unsuccessful in a merely summary examination of the factual and legal situation or which has brought about settlement of the legal dispute of its own volition (see BVerwG, order of 2 February 2006 - 1 C 4/05 -, juris para. 2; VGH BW, order of 26 July 2011 - 10 S 1368/10 -, juris para. 2; refusal to bring about settlement: Kopp/Schenke, VwGO, 24th ed. 2018, para. 161 marginal no. 17). If the outcome of the proceedings cannot be predicted on the basis of a merely summary examination - i.e. if the prospects of success are open - it is reasonable discretion to distribute the costs of the proceedings appropriately between the parties in accordance with § 155.1 VwGO (see BVerwG, decision of 2 February 2006, loc. cit.) 45 In the present case, there is some evidence to suggest that the action would already have been dismissed as inadmissible in respect of paragraph 2 of the decision. In this respect, it should not be a question of a challengeable administrative act which creates a legal obligation on the part of the plaintiff as the addressee. With the "regulation" in point 2, the defendant alone wanted to prepare further measures and announce them to the plaintiff. In any case, the plaintiff was not in need of legal protection - irrespective of the quality of the administrative act - because it was only an official procedural act within the meaning of § 44a VwGO (German Rules of the Administrative Courts) which cannot be challenged independently. Nevertheless, applying the legal concept of § 155.1 sentence 3 VwGO, it is in accordance with the principle of equitable discretion to order the defendant to pay all the costs. The challenge of number 2 of the ruling is only a subordinate annex to the challenge of number 2 of the ruling, which is the relevant subject of the dispute. 46 The decision on the provisional enforceability of the judgment with regard to costs follows from § 167 VwGO in conjunction with §§ Sections 708 et seq. ZPO. 47 Insofar as the proceedings have been discontinued and a decision has been made in this regard on the bearing of costs, this decision is unappealable (§ 92 (3) sentence 2 VwGO in conjunction with § 158 (2) VwGO). 48 In all other respects, the appeal is dismissed pursuant to § 124a para. 1 sentence 1 VwGO in conjunction with § 124a (2) no. 3 VwGO, because the Chamber considers the case to be of fundamental importance. In this respect, the information on legal remedies printed below applies. Order of the 1st Chamber of the Administrative Court of Mainz of 20 February 2020 49 The value of the subject matter of the dispute is set at €5,000 (§ 52(1) and (2) of the Gerichtskostengesetz - GKG).