LG Rostock - 3 O 762/19: Difference between revisions

Latest revision as of 13:58, 20 September 2021

LG Rostock - 3 O 762/19

Court:	LG Rostock (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 4(2) GDPR Article 4(2) GDPR Article 4(11) GDPR Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 13 GDPR Article 14 GDPR Article 21 GDPR Article 24 GDPR Article 26 GDPR Article 28 GDPR Article 44 GDPR Article 45 GDPR Article 95 GDPR Article 5(3) e-Privacy Directive § 15(3) Telemediengesetz § 3 Gesetz über Unterlassungsklagen bei Verbraucherrechts- und anderen Verstößen (UKlaG) § 8 Gesetz gegen den unlauteren Wettbewerb (UWG)
Decided:	15.09.2020
Published:
Parties:	Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv) Defendant: advocado GmbH
National Case Number/Name:	3 O 762/19
European Case Law Identifier:
Appeal from:
Appeal to:	Pending appeal OLG Rostock (Germany) unknown
Original Language(s):	German
Original Source:	Homepage of the plaintiff (decision not officially publsihed yet) (in German)
Initial Contributor:	Marco Blocher

The regional court of Rostock (LG Rostock) held that tracking cookies can only be placed with the user's active consent. A preset permission that is only to be confirmed via an "OK" button is not sufficient.

Further, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google.

The controller appealed, the decision is not (yet) in force.

English Summary

Facts

The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries.

The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies.

The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors.

(Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.)

Dispute

Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)?
Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR?
Did the defendant violate GDPR provisions on transparency?
Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers?

Holding

Legal basis and validity of consent

The court held that the marketing and analytics cookies used by the defendant can only be placed with the users' consent under Article 6(1)(a) GDPR: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons.

Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid.

Transparency

The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies.

Sole or joint controllership when using Google Analytics?

Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the official opinion of the "Datenschutzkonferenz", a gathering of all German DPAs.

Comment

Please note that the decision is not (yet) in force, as the controller filed an appeal with the OLG Rostock at which the case is now pending. Therefore, the decision is not officially published but only presented on the plaintiff's website, where one can download the (redacted) decision. Once the OLG Rostock has issued its decision, it will be linked here.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original as published on the webiste of the vzbv for more details. Please also note that below translation might be incomplete as is had to be created from a PDF document not readable in MS word.

Rostock District Court
In the name of the people
Verdict
In the litigation
Bundesverband der Verbraucherzentralen und Verbraucherverbände - Federation of German Consumer Organisations - Verbraucherzentrale Bundesverband e. V., represented by d. Vorsitzender, Rudi-Dutschke-Straße 17, 10969 Berlin
- Plaintiff -
Attorney-at-law-
against
advocado GmbH, represented by its managing director, Wolgaster Straße 14, 17489 Greifswald, Germany - Defendant
Litigants:
the Rostock Regional Court - 3rd Civil Chamber - by the Vice-President of the Regional Court as single judge on the basis of the oral hearing on 1 1 August 2020:
The defendant is ordered, in the event of infringement, to avoid an orderly fine to be determined by the court - in lieu of which orderly imprisonment or orderly imprisonment of up to six months (orderly fine in individual cases not exceeding EUR 250,000.00, orderly imprisonment in total not exceeding two years), to be enforced on its managing directors Mr and Mr
to refrain,
in the course of business dealings with consumers
-
1. use technologies in telemedia for tracking users for analysis and marketing purposes, which transmit users' personal data to third parties and thereby track users' behaviour across websites, if no informed and voluntary consent of the users within the meaning of Art. 4 No. 11, Art. 6 para. 1 s.l 'it. a) DSGVO and Art. 7 DSGVO has been given for this processing;
2. Offer telemedia without providing users with information at the beginning of the usage process on the justification pursuant to Art. 45 et seq. GDPR for transfers of personal data to a third country pursuant to Art. 13 (I) (f) GDPR in a precise, transparent, comprehensible and easily accessible form in clear and simple language;
3. in the case of joint responsibility for data processing pursuant to Article 26 (1) sentence 1 of the GDPR, not making the essence of the agreement between the joint controllers available to users, contrary to Article 26 (2) sentence 2 of the GDPR;
4. to use the following clause and clauses identical in content in general terms and conditions in relation to contracts with consumers for the mediation of legal services:
"Advocado reserves the right to unilaterally amend these GTC - insofar as they are introduced into the contractual relationship with the customer - at any time, insofar as this is necessary to eliminate equivalence disruptions that arise subsequently or to adapt to changed legal or technical framework conditions and these do not unreasonably disadvantage the user. advocado shall inform the customer of any changes by e-mail, stating the content of the amended provisions. This e-mail shall contain the amended GTC as well as a reference to the right of objection, the objection period and its consequences in the event of failure to object."
Il. The remainder of the application is dismissed.
III. The defendant is ordered to pay the plaintiff EUR 214.00 plus interest at five percentage points above the respective base rate since 19 June 2019.
IV. The costs of the proceedings shall be borne by the plaintiff at 117 and the defendant at 617.
The judgment is provisionally enforceable for the plaintiff with regard to paragraphs 1.1. - 4. against security in the amount of EUR 15,000.00. The remainder of the judgment is provisionally enforceable for the parties. The other party may avoid enforcement by providing security in the amount of 110% of the amount to be enforced, unless the enforcing party provides security in the amount of 110% of the amount to be enforced.
VI. the amount in dispute is EUR 17,500.00.
-
Facts
The parties dispute claims for injunctive relief in connection with alleged violations of data protection regulations by the defendant on its website.
The plaintiff is the umbrella organisation of the 16 consumer centres in Germany and is registered in the list of qualified institutions under § 4 UKlaG maintained by the Federal Office of Justice.
The defendant is the provider and operator of the internet platform with the domain www.advocado.de, through which people seeking legal advice are referred to lawyers who provide advice.
When the defendant's website was accessed on 16.08.2019, the following "cookie banner" (Annex K5) was displayed:
This website uses cookies

The four checkboxes at the bottom were pre-selected. By pressing the "OK" button, the users were supposed to agree to the use of the cookies. Via "Show details", it was possible to view a list of the cookies used and, among other things, their allocation to the individual categories "Necessary", "Preferences", "Statistics" and "Marketing". There was no separate option to opt out or opt out at this point. The defendant used the cookies mentioned in Annexes KI I-K15 on its website. Among them are so-called tracking and analysis tools, such as Google Analytics.
The Respondent provided the following information in its privacy statement (Exhibit KIO):

Privacy policy
This data protection notice informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data subjects") within our online offering and the websites, functions and pages associated with it (hereinafter referred to as "the data subject"). 4 dec Basic Data Protection Regulation (OSCVO).
Responsible body
advocado GmbH. represented by cfie Geschäftsfuhrec and , wotgastet strase 146. 7439 Greifswald, verantwortllCh. is responsible for data protection compliance of our oatine offer.
Please do not hesitate to contact us if you have any questions regarding data protection law. Here+u have the following contact options: n SSO
Fax: (0) 3834 44
E-mail: intr;
Data Protection Officer
In addition, we have appointed a data protection officer, the lawyer ('Syrøkus)Wolgaste- Straße 146, D-' 7489 Greifswald. He will be happy to answer any questions you may have regarding data protection law . For this purpose, you have the following contact options:
Tete-fort (0) 3834 / 0 83
3834 / 8844 421
Types of data processed:
• Inventory data (e.g. names. addresses).
• Contact details (e.g. EHail telephone numbers).
• Content data (e.g. text inputs. photographs. vdeos).
• contract data (e.g. subject matter of the contract, term, customer category).
• Payment data (7 B., Zahlungshiqtotle),
• Usage data (e.g.. web pages visited. :nterest in content. access times),
• meta./comnuration daEa (e.g. gegätelformauonen, F-addresses).
Processing of special categories of data (Art. 9(1) DSGVO):
No special categories of data are processed. No special categories of data are processed unless they are fed into the notter of processing, e.g. entered into ontineforr.utarea-.
Categories of data subjects concerned by the processing:
• Korøen (Client Lawyers).
• Interested parties,
• Cooperation partner.
• Applicants.
• Visits' and NJt2Ct of the Onlineangcbote
In the following, we will refer to the persons concerned collectively as 'users'.
5 -
Purpose of the processing:
• Provision of the ONiñe offer. its contents and functions.
• Provision of contractual services. Secvice and KuNjenDftege.
• Responding to contact requests and communicating with users.
• Marketing. Advertising and market research
• Safeguarding measures.
1. relevant legal bases
In accordance with Art. 13 OS-WO, we inform you of the legal basis for our data processing. If the legal basis is not stated wildly in the data protection declaration, the following applies: The legal basis for obtaining consent Art. 6 para. 1 lit. a and Art. 7 DSCVO. The legal basis for processing for the performance of our services and contractual measures as well as for responding to requests is Art. 6 para. 1 fit. b DSCVO. The legal basis for processing for the fulfilment of our legal obligations is Art. 6 para. 1 tit c DSCVO, and the legal basis for processing for the protection of our legitimate interests is Art. 6 para. tit t DSCVO. In the event that the vital interests of the data subject or another person require the processing of personal data, the legal basis is Article 6(1)(d) of the Regulation.
2, Changes and updates to the privacy policy
We ask reg-ebn-Cig to inform about the :nhalt of our We adapt data protection declaration. as soon as
We will inform you as soon as this is necessary due to the changes in the work carried out by VB.
changes require your cooperation (e.g. consent) or other individual disadvantage.
3. security measures
3. t. WÉ shall, in accordance with 37 OSGvo and taking into account the state of the art, the scope, the circumstances and the purposes of the processing of the different likelihood and severity of the rights and freedoms of the persons.
The measures include, in particular, ensuring the confidentiality and availability of the data by controlling both physical access to the data and access to the data itself.
We have established procedures to ensure that data subjects' rights are respected. We also take into account the protection of personal data. Furthermore, we take the protection of personal data into account as early as the "development" or "evaluation" of hardware, software and procedures. The principle of data protection is taken into account by means of data protection-friendly default settings (Art. 25 DSCVO).
ä. These include, but are not limited to, the encrypted transmission of data between our
4. Cooperation with processors and third parties
4.1. If we disclose data to other persons and companies (processors or third parties) within the scope of our processing, or otherwise grant them access to the data, this is only done on the basis of a legal requirement (e.g. if a transfer of the data to third parties, such as to payment service providers, is necessary for the performance of a contract): Data to third parties. such as payment service providers. in accordance with Art. 6 Para. 1 b DSCVO for the purpose of contract fulfilment. you have given your consent. a legal obligation to do so or on the basis of our legitimate interests (e.g. the use of webhosts. etc.).
4.2. If we entrust third parties with the processing of personal data on the basis of a contract, this is done on the basis of the provisions of Mt.
S. Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the course of using services or disclosing data to third parties, we will only do so if it is necessary for the performance of our (pre)contractual obligations, on the basis of your consent or if we are required to do so by law.
or on the basis of our legitimate interests. Subject to legal or contractual limitations.
or we will only process the data in a third country if the special conditions of Art. 44 et seq. of the GDPR are met. The processing is carried out, for example, on the basis of special guarantees, such as the officially recognised establishment of a level of data protection that corresponds to that of the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognised contractual provisions.
(so 9called standard verr.gskt.usetn-),
6. rights of the data subjects
6. have the right to To obtain confirmation as to whether personal data are being processed, information on data and further information and a copy of the data in accordance with the GDPR.
6.2. have according to. Art. '6 DSCVO the right. To complete the data concerning you or to correct the data.
6.3. of Article 17 of the Regulation, the right to be informed that
6 -
atternabv to request a restriction of the processing of the data in accordance with Art. 18 DSGVO.
64. you have the right to request that the data concerning you that you have provided to us be received in accordance with Article 20 of the Regulation and to request that it be transferred to other data controllers,
6.5 You have the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the OSCVO.
7. Right of withdrawal
You have the right to revoke your consent in accordance with Art. 7 (3) OSGVO with effect for the future.
8. Right of objection
You may object at any time to the future processing of data relating to you in accordance with Article 21 of the OSCVO.
9. Cookies and right to object to direct advertising
We use temporary and d. small oateler. stored on the cerSten of the users a tErktSrvng of the
term and function, last section of this privacy statement). For the ted serve the or are for the
The use of cookies is only necessary for the operation of our online services (website operation) or to save the user's decision when confirming the cookie scanner. In addition, we or our technology partners use cookies for reach and marketing purposes, about which users are informed in the course of the data protection declaration.
A general widegspruch oeoen the use det tu Zwecke des On lu-'emacketino eingesetzte Cookies bei einer der Dienste. allem im Fan des Trackings. über de US-amerikanische Seite http: "www.aboutads.info/choices/Oder die http://www.youronlÑchoices.com4 erklärt werden. Furthermore, the storage of cookies whose deactivation may affect the
settings of the browser can be reached. Please note that you will not be able to use this function.
10. Data deletion
10.1 The data processed by us will be deleted or restricted in accordance with Art. 1 7 and 1 e DSGVO Unless stated in this privacy policy, the data stored by us will be deleted as soon as they are required for their purpose and there are no legal retention periods for the data If the data are not deleted because they are required for other and legally permissible purposes, their use will be restricted. This means that the data will be saved and not processed for other purposes. This applies, for example, to data that must be retained for commercial or legal reasons.
Note text: Please fill in the applicable details for Germany or Austria. Please change this information if applicable for Sk Aufbewaht'ngspnghten:
10. Z. In accordance with legal requirements, retention for 6 years in particular § 257 para. 1 HGB (Handelsbúcher. "Venture,
Opening balances. Annual financial statements. Commercial letters, accounting vouchers, etc.) for 10 years in accordance with 147 paragraph AO . Accounting vouchers, commercial and business records. Documents relevant for taxation. ete).
I I. Provision of contractual services
11.1 We process inventory data (e.g. names and addresses as well as contact data of users). Contractual data (e.g. services received. Names of contact persons. Payment normatives) for the purpose of fulfilling our obligations and services according to Art. 6 para. 1 b. of the Data Protection Act. The information provided in the ontine forms is for the use of the user.
Conclusion of contract required
11.2. users can optionally create a user account. in which they can view their legal questions in particular. in the context of the
If a user registers, the necessary information will be provided to the user. User accounts are not accessible and cannot be indexed by search engines. If users have cancelled their user account, their data will be deleted with regard to the new account, subject to its retention being necessary for reasons of commercial or tax law or other legal reasons in accordance with Art. 6 Para. 1 tir c DSGVO. It is incumbent upon the users to save their data in the event of a cancellation before the end of the contract. We are entitled to delete irretrievably any data of the user saved during the term of the contract.
In the context of and renewed registrations for our services, we store the IP address and the time of the respective user action. This data is stored on the basis of our legitimate interests as well as the user's interest in protection against misuse and other unauthorised use. We do not pass on this data to third parties unless it is necessary for our claims or there is a legal obligation to do so in accordance with Art. S (it. c OSCVO
11.4 We process usage data (e.g. the number of visits to our website, interest in our products) and content data. Interest in our products) and content data input in the contact form or user profile() for advertising purposes in a user profile. Use special offers to display their b.sher used services.
1 1.S. Oje user data of the inquiring client is transferred to a lawyer as instructed.
The lawyer's user data to the requesting client. This is done for the purpose of the execution of the contract.
A forwarding of data to other third parties involved (e.g. legal expenses insurers or legal costs financiers) is not permitted.

after express commissioning by the Nutzet.
t 1.6 In the case of chargeable services, we process your user data, in particular payment data (account, credit card and other bank data) on the basis of the 6 para. it. b OSGVO This is done for the purpose of implementing the contract.
(payment processing and accounting). To the extent necessary, your payment details will be transferred to (credit institutions, accounting service providers) or processed directly by them for the payment transaction and for settlement.
11.7 The data shall be stored after the expiry of legal and verifiable obligations; the necessity of storing the data shall be reviewed three years after the expiry (end of the retention period under commercial law (S years) and tax law (10 years)); details in the deletion,
12. Contact
12.1. When de: Contactforrnutar or e-mail), the user's details are processed for the purpose of handling contact requests and their Art. 6 para. 1 tit b) DSCVO.
"We delete the requests. We are no longer able to respond to requests from customers for two years. If you have a customer account, we store it permanently and refer you to the details of the customer account for deletion. In the case of legal archiving rights, deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) retention period).
13. Collection of access data and log files
13.1. We collect data on the basis of our legitimate interests within the meaning of Art. 6 Para. 1 tit. f. DSGVO. DSGVO, we collect data on every access to the server on which this service is located (so-called " access data"). File. Date and time of access, upper data volume. Message about successful retrieval, browser type and version. the user's operating system. Return URL (the previously visited page). IP address and the provider used.
13.7. are stored for security reasons (e.g. for the clarification of misuse or fraud) for a maximum of seven days and then deleted. Data whose further storage is necessary for legal purposes shall be exempt from deletion until the validity of the complaint has been clarified.
14. Online presence In social media
14.1. We use social networks to communicate with customers, interested parties and users active there and to inform them about our services. We communicate with interested parties and users and inform them about our services there. When calling up the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.
14.2. We process the data of the users if they communicate with us within the social networks and platforms , e.g. write posts on online presences or send us messages.
15. Cookies & Reach Measurement
tS_1. Cookies are pieces of information that are transferred to the user's web browser by our web server or third-party web servers and stored there for a later period of time.
We use session cookies, which are only stored for the duration of the current visit to our website (e.g. to enable the storage of your login status or the shopping cart function and thus the use of our online services). In addition, a cookie contains information about its origin and the storage period These cookies cannot store any other data. Session cookies are deleted when you have finished using our online offer and, for example, log out or close the browser.
1 S.3. about the use of cookies in the context of pseudonymous r ng, users are informed in this
Data protectionMkUrung Informed
5.4 If you do not want cookies to be stored on your computer, you are requested to select the appropriate option in the system settings of your browser to delete cookies from the browser's system settings.
'S. S. You may refuse the use of cookies for reach measurement and advertising purposes by visiting the deactivation page of the
Network advertising initiative .orqn and additionally the US website
'Chokes) or the website (nttpV/www youronlinechoices widewechen
16. Google Analytics
16.1. "We use Google Analytics, a web analytics service of Goc9te LLC, on the basis of our legitimate interests (i.e. in the optimisation and economic use of our online offer in the sense of 6 para. 1 f. of the OSCVO). OSCVO) Google Analytics, a web analysis service of Google LLC CC0091 Google uses cookies. The information generated by the cookie about the use of the website by the users is used to

The data is usually transferred to a Google server in the USA and stored there.
16.2. Coogle is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https-Wwww.ÞriVðcyshielc1gov/particjpant?id-aZztOWOOOO 1
16.3. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity.
The purpose of the processing is to provide us with services related to online services and internet usage. In doing so, pseudo data files can be created from the processed pseudo data files.
16.4. We use Google Analytics to display ads served within Google's and its partners' advertising services only to users who have expressed an interest in our online offerings or who have certain characteristics (e.g., interests in certain topics or products as determined by the web pages they visit) that are transmitted to us.
b.w. With the help of the Rernar\eting Audiences we also ensure that our
Advertisements correspond to the potential interest of users and do not have a harassing effect.
ISS. We only use ana-ytics with ðkt;werter. This means that the IP address of the user is shortened by Google within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.
The IP address is merged with other data from Google. Users may refuse the use of cookies by selecting the appropriate settings on their browser, however please note that if you do this you may not be able to use the full functionality of this website, including the full functionality of this website.
16 For more information about Google's use of your data and your choices about not having it used by us, please visit the following websites: comfintt/en/policies/pnvacy/partners (-Oatenauäun9 by Google when you use apps from our' partners. hRps-Wpotjciesgooglecorn/techn0109ie$/ðds (.Catennattung tu Werberaecken-), authenticðted ("Jnf "maten. information that Google uses. to show you ads-.9").
17.
our: legitimate interests (i.e. interest in the analysis, optimisation and operation of our online offer within the meaning of Art. 6 para. tit. F. DSGVO) the Martetinq- und Remarketing-Oier.ste (in short -Google-Marketing-servicesl of Google Ireland Limited. Gordon House, Barrow Seeet. Dublin 4. Ireland, LGoogte-l.
17.2. Google is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with the European data protection law.
17.3. The Gocgle%marketin9 services allow us to target advertisements for and on our website to only show users ads that are potentially relevant to their interests. For example, if a user is shown ads for products they have been interested in on other websites, this is called remarketing. For this purpose, when our and other websites are accessed, Google executes a code directly from Google and integrates so-called "web beacons" (invisible graphics or code) into the website. The cookies are set on domains such as 90091exom. doubleclkk.net, Invitemedca.cnm. ad meld.com.googlesyndicat;on com or 90091eadservices.com- This file records which websites the user has visited, which he is interested in and which he has clicked on. Visiting time as well as further information about the use of the online offer. The IP address of the user is always recorded, whereby we communicate within the framework of Google Analytics that the IP address of the user is not stored.
Address within Member States of the Union or in other Contracting States to the Agreement on the European Economic Area.
Host name shortened and only in exceptional cases transmitted to a Google server in the USA and shortened there.
This address will not be merged with user data within other Google offerings. The aforementioned information may also be combined by Google with other information from other sources. If the user visits other websites, ads can be displayed that are tailored to his or her interests.
17 The data users are processed pseedonymously in the framework of the Gocgte-Mðrtcting-Secvices. Oh. Cooqle stores and processes
This means that, from Google's point of view, the ads are not managed and displayed for an identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has explicitly deafened Google to process the data without this pseudonymisation. The tnrormatõns collected by Google market;ng services about the tnrormatõns will be transferred to Google and stored on Google's sec-arn in the USA.
17. S. One of the Google marketing services we use is the online advertising programme AdWords. In the case of Google AdWords, everyone receives a different conversion cookie. The information collected with the help of the cookie is used to compile conversion statistics for the websites. The AdWords customers receive a total number of users who clicked on their ad and were redirected to a page with a cookie, so they all receive information that can be used to personally identify users.
17.6. We use the Google marketing service AdSense to serve third-party advertisements. AdSense uses a technology that enables Google and its partner websites to display ads based on users' visits to other websites on the Internet.
17.7. Also the Optimizct" clnsctzer. service. Google Optimizer allows you to see the effects of changes to a website (e.g. changes to the input fields).
9 -
For these test purposes, cookies are stored on the users' devices. Only pseudonymous data of the users is processed.
17 8. furthermore, we may use the "Google Tag Manager. to integrate the Google Andyse and marketing services into our website and to
17.9. further information on the use of data for marketing purposes h Coogte. can be found on the overview page:
https:!/polkks.øoogte.com/cechnotogies/ads.the from Google is available at https://poticies.googte.com/prwacy.
t'. 10 If you would like to opt out of receiving content-based advertising from Google Marketing Services, you can use the opt-out and opt-in options provided by Google https.//adssettings.googlexom/authenticazed
18. facebook pixeI
On the basis of Art. 6 Para. S 1 Et OSGVO, we use the Facebooklnc on our page -Facebook Pixet-. Hacker Way, Menlo Part,
CA 9402%. USA. or racebooi Ireland Ltd. 4 Crand Canat Square. Crand Can* Harbour, Dublin 2, Ireland. hereinafter -Facebook-. Fateboak Pixel is used for the needs-based design and continuous optimisation and analysis of our website and our services. Facebook Pixel enables us to display targeted advertising to Facebook users who show or show interest in our offer. This way, our advertising reaches the users who are interested in it and does not appear bcuqlgcnd. For more information on how Faceþook Pixel works, click here.
Facebook complies with European data protection law and is certified to the PrivacrShield agreement - .
The data collected by Facebook Pixel is also processed in accordance with the Facebook data processing policy httpswwwftceboek.eom'pobcy.php
You have the right to object to the collection of data by Facebook Pixel. Please note that you have the right to object to the use of Facebook's usage-based advertising: https://wwwfacebook.cora/settirgs?tabzads. The settings you make are not only limited to a certain number of parameters, but will also affect the devices you use as described above.
19. Facebook Social Plugins
19.1 We use Cf undlage unserer betechtigte Interessen (d.h. Interesse anatyse, Optimierung und w'rtschaftbchem Betrieb W'SereS S-nne des 6 Abs. lit. f. OSGVO) Satial Plu9ins CPtu9insW) of the social network facebook.com, which is operated by Facebook Iretand Ltd. 4 Grand Canat Square. Grand Canal Harbour. Dublin 2. Irtand aetricben (Tacebook-). The plug-ins can display action elements or content (e.g. videos, graphics or text) and are recognisable by one of the Facebook logos (white on a blue tile, the "I like it" or an "up" sign) or by the addition of the Facebook social plug. The I iste end the appearance of the Fatebook Social P(uqiqs can be viewed here: https-d/en-.-elope;sfacebook.com/docs/plugins/.
19.2 Face-bot* is the Shield-Abkornrr.en t*etet hie'duich a Gar attie. the Oateoschutzretht einzuhalten Olttps-Wwww.privacyshietd.90v/particiv-nt?id=aZzt00C0000CnrwAAC&status-.Active),
19.3. When a user calls up a function of this online offer that contains a p:ugin like this, his or her device establishes a direct connection with the servers of Facebook. The content of the login is transmitted by Facebook to the user's device and integrated into it. In doing so, network profiles of the users can be created from the processed data. "We therefore have no influence on the scope of the data that Facebook receives with the use of this plugin and therefore informs the users according to our knowledge.
19.4. Through the integration of the message, Facebook receives information that a user has called up the corresponding page of the website. If the user is logged into FatebOOk, Facebook can assign the visit to his or her Facebook account. When users interact with the ptu'ins, for example by clicking the Like button or posting a comment, the corresponding information is transmitted directly to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Fecebook will find out and store his or her JP address. According to Facebook, only an anonymised IP address is stored in Germany.
19.5. The purpose and scope of data collection and processing by Facebook, as well as the rights and options available to protect the privacy of users, can be found in Facebook's privacy policy: https://wwwfðccbooa
19.6. If eln user is and did not like. that Facebook this online offer collects data about him and links it with his M'tgt:edsdaten stored with Facebook, he must log out of Facebook before using our online offer and delete his cookies. Further settings and objections to the use of DÐten tur Weiber-wecke. are available within the
Facebookñofilhires m5gllch: Odet Ober dle US-aner.kanlsche Selte info/choires/ or the EV site com/, The settingsvrgen occur p;Bttf9' they are adopted for old devices. such as desktop computers or mobile devices.
20. Amazon Affiliate Program
20.1 We are aware of our interests (i.e. interest in the economic operation of our online offer of Art. 6 Para. lit. r. DSCVO), we participate in the partner program of Amazon, which is a medium through which the placement and links can earn advertising refunds. Amazon uses cookies in order to be able to trace the origin of orders. Among other things, Amazon stores cookies on the users ' devices for these test purposes. Only pseudonymous user data is processed.
17.8 We may also use Google Tag Managers to integrate Google's analytics and marketing services into our website.
7.9 For more information about Coogle's use of data for marketing purposes, please visit https: "poloes.google.com/technotogies/ads.Coogle's privacy policy is available at https//poticies.google.com/prwacy.
10 If you want to opt out of advertising through the van you can use the options provided https.//adssettings.googte.com/authenticazed
18. facebook pixet
On the basis of Art. 6 para. 1 S fOSGVO, we use "Facebook Pixet- of Facebook Inc. Ha:ker Way. Menlo Park.
CA 94025. USA. respectively racebook tretand 4 Grand Canal Square. Crand Can* Harbour, Dublin 2. hereinafter - Facebook- . The use of facebook bcdatfsgcrcchW1 Gcstaaung und fortlaufenden Optimicrung und Analyse unseret Seite Sowie unseres wirtschaftlichen Angebotes. Facebook pixels enable us to display targeted advertising to Facebook users who show or could show interest in our site. In this way, our advertising reaches the users who are interested and does not have a bct-sugcnd effect. In addition, it cemogbcht us ac Static evaluation to marketfo(schungszwetken. For more information on how pixels work, see ; .
Facebook would have complied with European data protection law and is certified to the Privacy Shield agreement:
The data collected by Facebook Pixel is also processed in accordance with Facebook's data use policy https-4fw-A* eom'pobcyphp you have a right to object to the collection of data by Facebook Pixel. Please use the settings option regarding Facebook's usage-based advertising: https://www.facebookcom/settirgs?tab-ðds. The settings you make are not limited to one device, but are applied to all the devices you use.
As described above, you can prevent cookies from being stored on your computer.
19. Facebook Social Plugins
19.1. We use this information for the purposes of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our website) in accordance with Article 6 para. 6 para. et. f. OSCVO) social plugins CPlusins') of the social network Facebook.com.which is operated by Facebook Ireland Ltd. 4 Grand Canal Square. Grand Canal Harbour. Dublin 2. "tand "etricben is Cface5---;. The piugíns can represent interaction elements or content (e.g. videos. graphs or text contributions) and are recognisable by a de' Facebook logcs
(white on blue tile, the words -Çefåtlt mir-, a "thumb " or the suffix "Facebook Sociaf Plug*n-. The t iste end the appearance of the Facebook Sociaf Pluqins can be viewed here: https://deyelopers.facebook.com/docs/plug;ns/.
19.2. F-ceb-tYA is to the Ptivacy.Shietd Agreement and offers hie'du'th a guarantee. to comply with the Data Protection retht thttpswwww.p.-ivacyshietd.wv/participant?id=aZ
19.3. When a user calls up a function of this website that contains a plugin, his or her device establishes a direct connection with the servers of Facebook. The content of the plugin is transmitted by Facebook to the user's device and integrated into the onlinet. We therefore have no influence on the scope of the data that Facebook collects with the use of this plugin and therefore inform the user according to our state of knowledge.
19.4. Through the integration , Facebook receives information that a user has called up the corresponding page of the online offer. If the user is a member of Facebook, Facebook can assign the visit to his or her Fatebook-K06to. If users are connected to the
If you click on the Like button or post a comment, the corresponding information is transmitted from your browser to Facebook and stored there. If a user is a member of Facebook, it is still possible for Fecebook to find out and save his or her IP address. La'R racebooi is stored in Germany ner anorwnised IP address.
19.5. The purpose and scope of the data collection and the processing and use of the data by Face500k as well as the rights and settings available to protect the privacy of users can be found in the privacy policy of Face500k: https://www.faccbook.com/-bo-Rlprivacy/,
19.6. If a user is a Facebook member and does not want Facebook to collect data about him or her via this online offer and to link it with his or her Facebook-stored user data, he or she must log out of Facebook before using our online offer and delete his or her cookies. Further settings and objections to the use of cookies for web purposes are possible within Facebook's profile divisions: https:/!www.racebook.com/settings?tatv ads Ode; Ober dle US warnenkanlsche Selte http -//wwwabovtads irfo/choires/ oder die EV-Seite http.//www.you:onlinecho-ices Pie Einstellvr:gen erfot9en dh. sie werden für Gerite. wie Desktopcomputer oder mobile Geräte Obernomrnen.
20. Amazon Affiliate Program
ZO.'. We are on Grvr-daqe of urserer interests (ie. Interest in the economic operation unsetes of Art. 6 para. 1 tit- f. DSCVO) Wlnchmcr dus Part:tetptogramms of Amazon conceived wu-de. by means of which by the Putziervng of and Links 20 Amaton.de can. Amazon sets cookies to trace the origin of orders.

you have clicked the partner link on this website.
For more information about Amazon's use of data, please see the company's privacy policy:
21 Newsletter
2; The following information will inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter, you declare that you agree to receive it and to the procedures described.
Z 1.2_ Content Newsletters: wÚ send newsletters, e-mails and other electronic messages with promotional information.
(hereinafter -Newslette--) nuc with the consent of the emotängee or a legal permission. If in the context of registration for the newsletter its content is specifically described, you are responsible for the user's data. In addition, our newsletters contain information on our products, offers, promotions and our company. Promotions and our company.
21.3 DouMe opt-ins and The registration for our newsletter is done in a so-called "confirmation" process, can register with a different e-mail address. All registrations for the newsletter will be stored.
In order to be able to prove the registration process in accordance with the legal requirements, it is necessary to store the registration and confirmation times, as well as the changes to your stored data.
21.4. The dispatch of the newsletter shall be effected by means of a newsletter distribution platform of the US provider.
Rocket Science Group. LLC. 67 S De Leon Ave NE gSOOO. Atlanta, CA 30 ì08. USA. The data protection provisions of the
You can view https://maitchimp.cornneqavprivacy/.The Rocket Science Group LLC is certified under the Privacy Shield Agreement, which provides a guarantee of compliance with the Privacy Shield (https://wwwvivðcyshietd.gov/participant?'d=a2zt0000000T06hAAGLstatus*Actwe).
Furthermore, according to its own information, the dispatch service may use this data in a pseudonymous form, i.e. without assigning it to a user, to optimise or improve its own services. For the technical optimisation of the dispatch and the
We use this data for the presentation of our newsletters or for statistical purposes. However, we do not use the data of our newsletter recipients to write to them ourselves or to third parties.
216. anmetdedÐten: To sign up for the newsletter, it is sufficient. if you enter your e-mail address
Z 1.7. The dispatch of the newsletter and the measurement of its success are based on the consent of the recipients' Art. 6 para. a, Art. 7 DSGVO 7 para. 2 No. 3 UWG or Crundtage of the sez%then permission according to ? Para. 3 UWG.
21 _g_ Protoco¥eerungdes Annetdeverfahren erfelgt auf çrvnaage unserer berechtigten Interessen gen Art. 6 Abs. 1 f DSGVO und dient dem Nachweis Cer Einwilligung in Empfang des Newsletters-.
Z 1.9_ - You can unsubscribe from our newsletter at any time. A link to unsubscribe from the newsletter can be found at the end of each newsletter. s_ If users have only subscribed to the newsletter and have cancelled this subscription, their personal data will be deleted.
22. integration of services and contents of third parties
22. We use within our on the basis of legitimate interests (i.e.. Interest in the Andyse. Optimisation of the operation of our ontine offer in the sense of Art. 6 para. lit DSGVO) Content- Ode:
We use the services of third party providers to integrate their content and services, such as videos or flash cards (hereinafter referred to as "content"). This always assumes that the third party provider of this content uses the IP address, as without it they would not be able to send it to your browser. The IP address is therefore required for the presentation of this content. We endeavour to use only such addresses. The IP address is only used by the respective provider to deliver the content. Third-party providers may use so-called pixel tags (invisible graphics, also known as "web beacons") instead of cookies or marketing tweets. These may be used to extract information such as visitor traffic to the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may be used, among other things, for technical purposes.
Information about browser and operating system. The information we collect about your visit to our website, the time of your visit and other information about your use of our website can be combined with information from other sources .
22.2 The following presentation provides an overview of third party providers and their services, together with links to their websites.
Data privacy statements, which contain further information on the processing of data and some of which have already been mentioned. Contradictions (so-called On-Out) contain:
• External from Google. LLC" h: tps-//www.googte.com/fonts ("Google Fonts"). The integration of Google Fonts by a server call at Google (usually in the USA). Data protection notice: https://policiesgoogle.com/pri-cy , Opt-Out: https://adssettiaçs.gooqle_ com/authenticated
• Web analytics and optimisation using the HotJar service from third party provider Hotjar Ltd Level 2 St Julians Bus-ness Centre. 3, Elia Zamrnit Street. St Julians STJ 1000. Malta. Europe, Hotjar can be used to track the movements of websites on which it is used (so-called heat maps). For example, it is possible to see how far users scroll and which buttons they click on. system. In this way, user profiles can be created temporarily during the visit to our website. It is also possible to collect feedback directly from the website. In this way we can collect feedback directly from the website.
Websites even faster: and more customer-friendly Privacy statement: https//www.hotjar.com/privacy
ODt-Out;
• This webs;te uses TwiiO. a service-100t of Twito it eland Limited, 25-28 Notth Watt Quay. Dublin 1. Ireland. to improve d.e Xundenkornmunaauon. Data is exchanged rwr encrypted between Tw-jlio and advoc-do. This is especially to provide our Kurds with a secure authentication and "ut det ptatform tu gewahr;egsten. For example, we can inform our customers even faster about changes 'm customer account with the help of SMS messages. The latest data on Twilio and additional information can be found on this website: h ttps://www.twižio.com/le-gat/privðcy
• This website uses conversion tacking from Microsoft (Microsoft Corporation, One Microsoft Way. Redmond. WA 98052-6399.
USA). Microsoft Bing Ads sets a cookie if our website is accessed via a Microsoft Bing ad. Bing and in this way. This means that the ad has been forwarded to the website and has reached a certain target page (Conversian page). We only learn the total number of users who clicked on an ad and were then redirected to the conversjon page. Personal information about the identity of the user is collected. If you do not wish to participate in the tracking process, you can refuse the setting of cookies by changing your browser settings. Further information on data protection and the cookies used can be found on the Microsoft website: http-Wprivacymicrosoft.com/en-de/fctlnotice-nspx.
You can prevent Bing from collecting your data by clicking on the following link. An opt-out cookie will be set to prevent future collection of your data when you visit this website:
23. integration of the Trusted Shops trust badge
2 Zv Anteige unseres Trusted Shops COtesiegetS und der gegebenenfalls gesammelten Bewertungen sowie tum Angebot der Trustee Shops Produkte for Kðufer nach einer Bestellung Ist diewr Webseite das Trusted Shops Trustbadge
Z3.Z This serves to protect our legitimate interests in an optimal marketing of our offer in the context of a balancing of interests pursuant to Art. 6 para. 1 p. 1 lit. f DSCVQ The Trustbðd9e and the services advertised with it are an offer of ecr Trusted Shops GmbH. Subbelrather Str 50823 Cologne.
233 When the trust badge is called up, the web server automatically saves a so-called server log file, which contains, for example, your IP address, the date and time of the data volume transferred and the requesting provider (access data). This access data is not evaluated and is automatically overwritten at the latest seven days after the end of your visit to the site.
23.4 Further personal data will be transferred to Trusted Shops if you have agreed to this. decide to use Trusted Shops products after completing an order or have already registered for the use of Trusted Shops products in this case the contractual agreement between you and Trusted Shops applies.
24. Integration of Xing
Due to our interest in increasing our level of awareness (within the meaning of Art. 6 para. 1 [it. f. DSGVO), we integrate the functions of the XING AG network, Oarr.mtorstraße 29-32.20354 Hamburg, Germany, on our website. Whenever a page is opened in which the functions integrated by XING are used, a link is established to XING. No personal data is stored, in particular no IP addresses are transmitted to XING. For further information, please refer to Xing's data protection statement at: https://wbw.xing.com/app/share?op=dåta_prctection
25. Integration of Linkedln
For the purposes of our legitimate interest in increasing our visibility (within the meaning of Art. 6(1)(E) DSCVO), we include plug-ins from Unkedln CorpMðtion on our website. 20¿9 Stierlin Court, Mountain View. CA 94043. USA. You can recognise the plug-ins by the U nkedln logo.
The plug-in establishes a direct link between your browser and the Linkeðln servers We have no e_nnuss on the nature and Umfarq of the data. wežche the plug in to the server Llnkedln transmits. You can find information on this here: https://wwwAinkedincomT.egaVprivacypolicy, Opt-Out:
The plug-in informs you that you, as a user, have visited this website. If you are logged in while visiting this website, your address will be linked to this information.
If 9e use the functions of the Aug-.ns - for example by using the Linkedln button - dk corresponding information is also transmitted to Linke-din
Mbchten Ste vertirndcrn, dass Unkedln vokr,gpft diese Daten mit ihrem Linkcdln-nccount. log SIC bitte sich vor dem Besuch Website bei Linkean und tuschen SIC de gespeicherten Cookies,
Linkedln is certfi'ed under the Privacy Shield agreement: https-4/www.privacyshield90v/participant?id=a2ztOOOOOlOtRAA08 Status-Attive.
Z'. Integration of and Ovtbraln Pixel
A visitor pix and cookies of Outbrain Inc. 39 West 13th Street, 3rd ftoar. New York. NY 10011. USA are used for legitimate interest pursuant to A't. 6 Para. I Lt DSCVO and are also used for conversion measurement. This means that the behaviour of users can be tracked after they have clicked on an advertisement on the provider's website. The purpose of this process is to statistically and
The data we collect is anonymous and does not provide us with any information about the identity of the user. You may opt out of 1 racking by Outbrain at any time by checking the opt-out box under Outbrain's privacy policy, available at y:ri:',. Here you will also receive further information about the device you are using and the data you have provided.
A and cookies of 26 West 23rd St. Sth New NY 10010. USA are used within the framework of the legitimate interest pursuant to Art. 6 para. tii f OSGvO on the advocado-lnternetseiten zur Konversionsmessun9 So the behaviour of matern nachverfolgt werden. nach dresc durch Klick auf eine labð515 Werbeanzeige auf Website des Anbieter weiterleitet wurden. This process is used to evaluate the effectiveness of the Taboola advertising campaigns for statistical and market research purposes and can help to optimise non-informative advertising measures.
Conclusions about the identi.ty of the users. You can object to tracking by laboola at any time: to do this, click on the field
You can opt out under Taboota's privacy policy, which is available at . The opt-out is valid for the device you are using and will expire when you delete your cookies. The deletion of the data thus transmitted will take place within months.
27. complaints and warnings
If you feel that your rights have been violated or that you have been otherwise adversely affected, please let us know. You will then receive a personal, individual reply Within the scope of our duty to mitigate damages, we would like to point out that we will not be liable for any costs incurred by a lawyer instructed by you out of court without first contacting us. We expressly do not accept any responsibility for you instructing a lawyer to issue a declaration of discontinuance with a penalty clause. Consequently, a presumed intent cannot be relied upon.
Status: August ZOI 9
This website uses cookies We use cookies to personalise content and ads. Social media features
We do this in order to provide you with the best possible service and to analyse the traffic on our website. We also share information about your use of our website with our partners for measurement, evaluation and analysis. Partners may combine this information with other information that you have provided to them or that they have collected in the course of your use of the Service .
Cookies are small text files used by websites to make user experience more efficient.
By law, we may store cookies on your computer if they are strictly necessary for the operation of this site. Fug old other cookie types require your permission.
Se ite uses different 'iche cookie types 'i. Some cookies are placed by third parties. the pages appear from the cookie statement on our website other ode: wicdcrrvfen
Erft about it. who we how you can ntact us and we pelsonenberogene
Data
Consent applies to the following domains: beratungudvocaoode right .advocado.de, g:uecksspieLadv0Cðdode.
erbrecht.advocado.de, advccadod-
Your current state CON.os allow (Necessary Ptaferenzen. Statistics, Marketing).
update
The defendant refers to the General Terms and Conditions submitted as Annex K15 when mediating legal services to consumers via the aforementioned internet platform. This states, inter alia, in clause 10:
"Advocado reserves the right to unilaterally amend these GTCs - insofar as they are introduced into the contractual relationship with the customer - at any time, insofar as this is necessary to eliminate subsequent equivalence disruptions or to adapt to changed legal or technical framework conditions and these do not unreasonably disadvantage the user. advocado shall inform the customer of any changes by e-mail, stating the content of the amended provisions. This e-mail shall contain the amended GTC as well as a reference to the right of objection, the objection period and its consequences in the event of failure to object."
In a letter dated 30 April 2019 (K16), the plaintiff demanded that the defendant cease and desist.
-
sion. The defendant rejected this.
The defendant subsequently changed the cookie banner as follows:
This website uses cookies
Wil ver.-.encen cookies. our i. tÆbste carstel!e!' to be able. These cookies are not deactivated and are used to provide better content and features to social networks and to analyse traffic to our website. We also share information about our use of the site with our social media and analytics partners. Our partners may combine this information with other data that you have provided to them, such as information collected in the course of your use of the Services, you provide to our cookies when you click on the "Allow" button.
Cook "allow it
Leta 's v
The plaintiff submits that due to the scripts and similar third-party technologies implemented in the defendant's website, which, for example, place third-party cookies on users' end devices, store personal data therein, read out and evaluate user information, personal data such as the IP address and browser information of website visitors are processed across websites for the purposes of advertising, the creation of user profiles and for comparable commercial purposes. However, this processing is not lawful. Thus, even taking into account the cookie banner, there was no effective consent of the consumers within the meaning of Art. 4 No. II, 6 para. I sentence I lit. a), 7 DSGVO. On the one hand, in view of the pre-filled checkboxes, there was no effective expression of consent. Furthermore, there was no possibility to refuse the setting of third-party cookies or to select or deselect individual providers. In addition, the cookie banner did not contain the necessary information for informed consent pursuant to Art. 4 No. II DSGVO. There was also no other legal basis for the processing of the data within the meaning of Art. 6 para. 1 DSGVO. The cookie banner used in the meantime was also not suitable for providing effective consent. The plaintiff is further of the opinion that the defendant's data protection declaration violates the information obligations under Art. 12 et seq. DSGVO and the principles of transparency and good faith. Furthermore, there is a breach of the information obligations under Article 26(2) sentence 2 of the GDPR, since the defendant and the third party providers are to be regarded as joint controllers with regard to the processing of personal data taking place, about which the defendant does not provide information. There is a lack of an agreement between the defendant and the third party providers, which is necessary in this respect, and the transparent publication thereof vis-à-vis consumers. Finally, the plaintiff is of the opinion that the clause in clause 10 of the General Terms and Conditions of Business and Use is invalid.
The plaintiff requests,
Order the defendant, upon avoidance of a fine to be fixed by the court for the case of infringement - in lieu of which, order imprisonment - or order imprisonment for a term of up to six months, (order fine in the individual case not exceeding EI-JR 250,000.00, order imprisonment for a total term not exceeding two years), to be enforced on its managing directors
Mrand Mr
to refrain, in the course of business dealings with consumers, from
use technologies in telemedia for tracking users for analysis and marketing purposes that transmit users' personal data to third parties and thereby track users' behaviour across websites,
if no informed and voluntary consent of the user within the meaning of Art. 4 No. I I, Art. 6 (1) sentence l lit a) DSGVO and Art. 7 DSGVO has been given for this processing;
2.
offer telemedia without providing users with information pursuant to Art. 13, Art. 14, Art. 7 (3) sentence 3 as well as Art. 21 (4) GDPR relating to the processing in a precise, transparent, comprehensible and easily accessible form in clear and simple language at the beginning of the usage process;
3.
in the case of joint responsibility for data processing pursuant to Article 26 (1) sentence I of the GDPR, not making the essence of the agreement between the joint controllers available to users, contrary to Article 26 (2) sentence 2 of the GDPR.
4.
to use the following clause and clauses identical in content in general terms and conditions in relation to contracts with consumers for the mediation of legal services:
"Advocado reserves the right to unilaterally amend these GTCs - insofar as they are incorporated into the contractual relationship with the customer - at any time, insofar as this is necessary to eliminate equivalence disruptions that arise subsequently or to adapt to changed legal or technical framework conditions and these do not inappropriately disadvantage the user. advocado shall inform the customer of any changes by e-mail, stating the content of the amended provisions. This e-mail shall contain the amended GTC as well as a reference to the right of objection, the objection period and its consequences in the event of failure to object."
5.
The defendant is ordered to pay the plaintiff EUR 214.00 plus interest at five percentage points above the respective base rate since 19 June 2019.
The defendant requests that the action be dismissed.
It submits that the plaintiff itself uses the Matamo analysis tool on the website it operates, so that the action against the defendant is an abuse of rights. Moreover, the application under I. is inadmissible for lack of sufficient specificity. It further submits that it did not use the
cookie banner and the privacy policy on 01.10.2019 due to the ruling of the ECJ of 01.10.2019 (Ref.: C-673/17 ). Until then, also taking into account the publications of the Conference of the Independent Data Protection Authorities of the Federation and the Länder (DSK), the legal opinion held by the DSK that there is a legitimate interest pursuant to Art.
6 para. I lit. f) DSGVO in the collection and processing of data could not be objected to. Consequently, it had also provided comprehensive and comprehensible information about the data collection, citing the relevant legal basis. The processing of personal data in dispute was covered by the users' consent. The consent was voluntary within the meaning of Art. 4 No. Il DSGVO. The users would be enabled to make an informed decision. Even more extensive information, as demanded by the plaintiff, would not be practically feasible. The plaintiff does not explain to what extent a violation of the information obligations pursuant to Art. 12 et seq. GDPR should exist. There is no joint responsibility within the meaning of Article 26 (2) sentence 2 of the GDPR. The defendant was the sole responsible party and had commissioned the third-party providers with the processing of the data. The third party providers had no decision-making powers with regard to data processing and were bound by instructions. Data processing not in accordance with the defendant's specifications was inadmissible. There was thus commissioned data processing pursuant to Article 4(8) of the GDPR. The objectionable adjustment clause was admissible. It contained the requirements and the scope of the permissible changes. In addition, it had to be taken into account that the defendant did not offer any paid services to its clients. It merely referred the clients to the appropriate lawyers.
Reasons for decision
l.
The action is largely admissible.
However, to the extent that the applicant requests under point 2 that the defendant refrain from offering telemedia without providing users, at the beginning of the usage process, with information pursuant to Article 14 GDPR relating to the processing in a precise, transparent, comprehensible and easily accessible form in clear and simple language, the action is inadmissible for lack of sufficient specificity of the claim.
1 .
The plaintiff has standing to sue.
a)
With regard to the applications under I., 2. and 3., the right to bring an action follows from § 3 para. Section 2(1) sentence 1, (2) sentence 1 no. 11 UKlaG in conjunction with Section 15(3) sentence 1 TMG. Section 15 para. 3 p. 1 TMG.
The hitherto disputed continued application of SS 11 et seq. TMG (cf. e.g. OLG Hamburg, WRP 2020, 505; OLG Stuttgart, WRP 2020, 509; also plaintiff's statement of 28.06.2018 at: https://www.vzbv.de/sites/defauIt/fiIes/downIoads/2018/06/29/18-06-28_vbv-steIIungnahme_ dsk_ tmg-dsgvo.pdf) has been confirmed by the Federal Court of Justice to the effect that the consent requirement for cookies continues to be assessed pursuant to Section 15 (3) sentence I TMG in a Directive-compliant interpretation according to the ePrivacy Directive, and not according to the GDPR.
However, the continued applicability does not only refer to the consent requirement itself, but also to the information and clarification obligations existing in connection with the processing of personal data by means of cookies "for purposes of advertising, market research or for the needs-based design of telemedia" (cf. Section 15 para. 3 p. 1 TMG). Art. 5 para. 3 p. 1 of the ePrivacy Directive (RI- 2002/58/EC) states: "Member States shall ensure that the storage of information or access to information already stored in a subscriber's or user's terminal equipment is only allowed if the subscriber or user concerned is informed, on the basis of clear and comprehensive information provided in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing.The interpretation of the provision of Section 15 (3) sentence 1 of the German Telemedia Act in conformity with the Directive as stipulated by the Federal Court of Justice therefore also requires the inclusion of all information duties. The plaintiff also expressly invokes Section 15 (3) sentence I TMG.
A stay of proceedings against the background of the preliminary ruling procedure of the
Court of Justice of the European Union in the legal dispute before the Federal Court of Justice, Ref.: I ZR 186/17, in the matter of Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. ./. Facebook Irland Limited - is therefore not indicated.
With regard to the application under 4, the right to bring an action exists pursuant to 3 para.
2.
However, the second request is partially inadmissible for lack of sufficient specificity of the claim.
a)
Pursuant to section 253 (2) no. 2 ZPO, an application for an injunction - and pursuant to section 313 (I) no. 4 ZPO, a judgment based on it - may not be worded so vaguely that the subject matter of the dispute and the scope of the court's power of review and decision (s. 308 (I) ZPO) are not recognisably delimited, the defendant is therefore unable to defend himself exhaustively and the decision as to what the defendant is prohibited from doing is ultimately left to the enforcement court. For this reason, applications for injunctions that merely repeat the wording of a law are generally to be considered too vague and thus inadmissible. A different approach may apply if the statutory prohibition is unambiguous and specific, its scope of application is clarified by an established interpretation or the plaintiff makes it sufficiently clear that he does not claim a prohibition in the scope of the wording of the law but orients his request for injunctive relief to the specific act of infringement. In such cases, however, the specificity of the request for an injunction generally requires that there is no dispute between the parties that the conduct complained of fulfils the element of the offence in question (see BGH GRUR 2017, 422 - ARD-Buffet).
Sufficient definiteness is also to be affirmed if the interpretation of the request on the basis of the plaintiff's factual submission clearly shows what is sought (see BGH GRUR 2015, 1237 - Erfolgsprämie für die Kundengewinnung).
b)
The request under point 2 is thus inadmissible to the extent that the defendant is to refrain from offering telemedia without providing users with information pursuant to Article 14 GDPR relating to the processing in a precise, transparent, intelligible and easily accessible form in clear and plain language at the beginning of the usage process.
The request to 2. refers to the omission of the offer of telemedia without providing users with information pursuant to Art. 13, Art. 14, Art. 7 para. 3 sentence 3 as well as Art. 21 para. 4 GDPR, which relate to the processing, in a precise, transparent, comprehensible and easily accessible form in clear and simple language at the beginning of the usage process.
(2) The plaintiff has substantiated his claim by complaining about the lack of information about the rights of access, deletion, rectification and appeal to the supervisory authority pursuant to Article 13 (2) of the GDPR. In addition, the plaintiff has cited the lack of information pursuant to Article 13(I)(f) of the GDPR on transfers of personal data to a third country as well as the lack of a justification pursuant to Article 45 et seq. of the GDPR. GDPR. Furthermore, the plaintiff cited the lack of information about the right of withdrawal pursuant to Art. 13(2)(c) of the GDPR on the cookie banner as a violation. Finally, he alleges a violation of the information in a "precise, transparent, comprehensible and easily accessible form in a clear and simple language" by the fact that several legal bases are stated with regard to data processing by means of third-party cookies, although only the relevant legal basis should be stated pursuant to Art. 13(1)(c) GDPR,
(3) Insofar as the application refers to Article 7 (3) sentence 3 and Article 21 (4) of the GDPR, this is sufficient, as the standards themselves define in a sufficiently clear and concrete manner the requirement to inform the data subject about the right of withdrawal with regard to consent given or the general right to object to data processing.
c)
On the other hand, the plaintiff did not elaborate on the violations of Art. 14 GDPR (information obligations if the personal data are not collected from the data subject) mentioned in the application in the statement of grounds. Since the infringement is already not described, the application, which only consists of a reference to the statutory provision, is not to be considered sufficiently specific.
d)
Apart from that, however, the applications are sufficiently specific and thus admissible. Insofar as the defendant expressly cites the insufficient definiteness of the application under No. I, the Chamber does not follow this objection.
(1) The action to be refrained from is sufficiently defined in the request to I . The defendant is to refrain from using technologies for tracking users for analysis and marketing purposes, which transmit users' personal data to third parties, unless the users have given their informed and voluntary consent. In this respect, there is no need to specifically name individual technologies ("cookies") to which the injunction is to apply.
(2) Whether and which technologies the defendant uses unlawfully from the plaintiff's point of view is solely relevant to the merits of the action. The plaintiff does not have to limit himself to only prohibiting the defendant from using technologies already in use, nor does he have to specifically name all conceivable technologies. In this respect, it is sufficient that, on the one hand, the objectionable mode of action of the technologies used is defined, in this case the transmission of personal data to third parties through the tracking of users for analysis and marketing purposes and, on the other hand, the absence of effective consent as a further prerequisite.
(3) Insofar as the application uses terms from the wording of the GDPR with regard to consent, which - as the case law of the last few years shows - were quite contentious in detail, it is necessary, with reference to the statement of grounds for the action and in accordance with the decisions of the ECJ of 1 October 2019 and the Federal Court of Justice of 28 May 2020 on the necessity and form of effective consent in the use of cookies (cf.2019 and the BGH of 28 May 2020 on the necessity and design of effective consent in the use of cookies (see ECJ GRIJR 2019, 1198 - Planet 49; BGH GRUR 2020, 891 - Cookie Einwilligung II), it can be assumed that these terms are also sufficiently specific.
3.
An abuse of rights by the plaintiff in the prosecution of the defendant is not apparent. Insofar as the defendant refers to the use of the analysis tool "Matamo" for its objection, this reference is already unsuitable because with this technology there is precisely no transmission of data to third-party providers (cf. only the entry "Matamo" at WIKIPEDIA).
Il.
The action is completely unfounded with regard to the application under I 3. and 4. and with regard to the (partially) admissible application under 2. also only partially unfounded.
The plaintiff is entitled to claim damages against the defendant pursuant to § 2 para. Art. 5 para. 3 ePrivacy-RL in conjunction with. The defendant is entitled to injunctive relief pursuant to section 15 para. 3 sentence I of the German Telemedia Act (TMG) in accordance with the operative part of sections I., 2. and 3. and pursuant to section I para. I UKlaG and sections 8 para. I, 3 para. I, 3a UWG in accordance with the operative part of section 4.
1.
The plaintiff has a claim against the defendant for an injunction against the use of technologies in telemedia for tracking users for analysis and marketing purposes, which transmit personal data of users to third parties and thereby track the behaviour of users across websites, if no informed and voluntary consent of the users has been given pursuant to Art. 5 para. 3 ePrivacy Directive in conjunction with Art. 15 para. Section 15 (3) sentence I of the German Telemedia Act (TMG) for this processing.
The provisions of the GDPR are not directly applicable due to the blocking effect of Article 5 (3) of the ePrivacy Directive pursuant to Article 95 of the GDPR. However, the content of the information and education obligations is nevertheless derived from the provisions of the GDPR. This is because Article 5(3) of the ePrivacy Directive refers to the Data Protection Directive (Directive 95/46/EC), which in turn is to be understood as a legal consequence reference to the GDPR pursuant to Article 94(2) of the GDPR. Therefore, the norms of the GDPR, specifically Art. Art. 4 No. I I , Art. 6 para. 1 sentence l lit a), Art. 7, Art. 12, Art. 14 and Art. 26 para. 2 sentence 2 DSGVO. Insofar as the provisions of the GDPR are referred to in the following, this is done in the aforementioned sense.
a)
The defendant unauthorisedly processed personal data by transmitting it to third parties without the effective consent of the users pursuant to S 15 para. 3 sentence I TMG.
(1) Pursuant to Article 5 (1) (a) of the GDPR, personal data must be processed lawfully, fairly and in a manner that is comprehensible to the data subject. The processing of personal data is lawful if at least one of the conditions set out in Art. 6 (I) of the GDPR is met.
aa) According to Art. 4 No. I GDPR, "personal data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Thus, the dynamic IP address that is stored by a provider of online media services when a person accesses a website that this provider makes generally accessible also counts as a personal data for the provider (cf. BGH NJW 2017, 2416 with reference to ECJ NJW 2016, 3579).
bb) According to Art. 4 No. 2 GDPR, "processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The provision or disclosure to a third party is indisputably "processing" within the meaning of the GDPR.
(2) The defendant uses technologies on its website that place third-party cookies on users' end devices. The use of the cookies referred to in Annexes KI I - K13 is undisputed.
The plaintiff further argued, naming various tracking cookies, that personal data, such as the IP address, was transferred across websites. With regard to the implemented tool "Google Analytics", the defendant denied that the IP address was forwarded to the third party provider. In all other respects, however, it merely denied in general terms that data is transmitted across websites.
This is insufficient in this respect, as the defendant bears the burden of presentation and proof that the design of the website complies with data protection law, as follows from Art. 5(2) and Art. 24(1) DSGVO (cf. BeckOK DatenschutzR/Schantz, 32nd ed. 1.5.2020, DS-GVO Art. 5, marginal no. 39 with further references). Since the tracking technologies specifically named by the plaintiff (cf. written statement of 04.06.2020, p. 7) are not only capable in principle, but are also regularly used precisely to collect personal data and transmit it to third-party providers, the defendant would therefore have to specifically state and demonstrate that the cookies mentioned do not transmit any personal data to other websites. It did not meet this burden of proof.
Moreover, in its privacy policy (Annexes KII - K13), the defendant itself described the function of the cookies in the description of the cookies to the effect that they serve to track the user across several websites and also to identify the user across visits and devices.
(3) The consent required for the use of these cookies could not be obtained at the time of the warning with the cookie banner used by the defendant (Annex K6).
be issued effectively.
aa) The use of the cookies in dispute here requires consent. The necessity of consent results from Section 15 sub-section 3 of the German Telemedia Act (TMG), which, in view of the provision in Article 5 sub-section 3 sentence I of Directive 2002/58/EC (E-Privacy Directive), is to be interpreted in conformity with the Directive to the effect that the service provider may only use cookies to create user profiles for the purposes of advertising or market research with the consent of the user (see BGH
GRUR 2020, 891 - Cookie Consent Il).
bb) The users could not give effective consent to the data processing specifically objected to here with the cookie banner provided by the defendant (Annex K6) due to the selected default setting - all cookies selected (so-called opt-out). With the decision of the Federal Court of Justice of 28 May 2020 on the necessity and the design of effective consent in the use of cookies (see Federal Court of Justice GRUR 2020, 891 - Cookie Consent Il), it is clear that the opt-out variant chosen by the defendant is not suitable for this purpose.
b)
The presumption of the existence of a risk of repetition based on the infringement to be established is not rebutted by the submitted change of the banner. At the oral hearing, the board corrected its initial indication in this respect in the summons of 14 April 2020. In the board's view, the defendant had not (yet) eliminated the infringement. The cookie banner now used by the defendant also does not fulfil the requirements for effective consent.
According to Art. 4 No. Il GDPR, "consent" of the data subject means any freely given specific, informed and unambiguous indication of his or her wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her.
The BGH stated in the aforementioned decision:
According to Article 4(II) of Regulation (EU) 2016/679, consent is any freely given specific, informed and unambiguous indication of wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to personal data relating to him or her being processed. According to Recital 32 of Regulation (EU) 2016/679, consent should be given by an unambiguous affirmative act indicating voluntarily, for the specific case, in an informed manner and in an unambiguous manner, that the data subject consents to the processing of personal data relating to him or her. Consent is given for the specific case if the content, purpose and scope of the declaration are sufficiently specific (cf. BeckOK.DatenschutzR/Schild, 31st edition [as of 1 February 2020], Art. 4 DS-GVO marginal no. 125; Buchner/Kühling in Kühling/Buchner, DS-GVO BDSG, 2nd edition, Art. 4 DS-GVO marginal no. 8).
(2) Effective consent is therefore also not possible with the cookie banner now used. This is because all cookies are pre-selected and are "activated" by pressing the green "Allow cookie" button. Thus, the design of the cookie banner basically corresponds to the design in the case decided by the BGH. Although the consumer has the option of having the details displayed

and to deselect individual cookies. In fact, however, the consumer will regularly shy away from the effort of such a procedure and therefore press the button without prior information about the details. In this way, the consumer does not know the consequences of his declaration.
The fact that with the cookie banner now used, the user also has the option of limiting his consent to technically necessary cookies via the "Only use necessary cookies" area does not change the assessment. In this respect, it should be noted that this button is not even recognisable as a clickable button. In addition, it also takes a back seat to the "Allow cookie" button, which is highlighted in green and thus appears to be pre-assigned. This option will therefore not be perceived as an equivalent consent option by a large number of consumers. The introductory text does not change this, as it does not explain which cookies are pre-assigned and how, and thus which cookies are "activated" by which button.
2.
The plaintiff has a claim against the defendant to cease and desist from offering telemedia without providing users with information at the beginning of the usage process on the justification ground pursuant to Art. 45 et seq. DSGVO for the transfer of personal data to a third country pursuant to Art. 13 para. 1 lit f) DSGVO.
However, the further application under point 2 is unfounded.
a)
The defendant - based on the failure to recognise the necessity of the user's consent - provided the wrong justification ground under Art. 45 et seq. DSGVO for the transfers of personal data to a third country pursuant to Art. 13 (I) (f) DSGVO. In this respect, the indication of several legal grounds is also not "precise" in the sense of Art. 12 (I) sentence 1 GDPR.
Moreover, the information provided by the defendant in No. 5 of the data protection statement on the basic possibility of transferring data to third countries and the basis for this is sufficient. This No. contains the - then incorrectly implemented - information that a transfer only takes place if the special requirements of Art. 44 et seq. DSGVO are met. The defendant has also named the relevant agreement within the meaning of Art. 45 para. I DSGVO (cf.: Google Analytics - No. 162; Google Re/Marketing Services - No. 172, Facebook Pixel - No. 18, 2nd paragraph; Facebook Social Plugins - No. 192; Newsletter- No. 21.4; LinkedIN No. 25, 6th paragraph).
b)
However, the plaintiff does not have a claim against the defendant for an injunction against the offering of telemedia without providing users with information at the beginning of the usage process pursuant to Art. 13 of the German Telemedia Act.
Paragraph 2 of the GDPR on the rights of access, erasure, rectification and complaint to the supervisory authority. A violation of these information requirements by the defendant is not apparent.
(1) The plaintiff complains that "in the disputed email of 10.04.2017 (see Annex K 3), the legally required mandatory information is not even rudimentarily fulfilled. For example, there is no information about the rights of the data subjects, such as the right to information,
rights of cancellation, rectification and complaint to the supervisory authority in accordance with Att 13(2) GDPR."
(2) It is already not apparent which email the plaintiff wants to refer to. A corresponding email is not the subject matter of the dispute and is (consequently) not available. In this respect, the argument regarding the violation of information obligations in or through this email is not relevant for the present legal dispute.
(3)
Notwithstanding this, it must be noted that the defendant's data protection statement does not contain the information pursuant to Alt. 13 para. 2 lit. b) DSGVO about the existence of a right of access on the part of the controller to the personal data concerned as well as to rectification or erasure or to restriction of processing or a right to object to processing as well as the right to data portability, as well as the existence of a right to lodge a complaint with a supervisory authority pursuant to Art. 13 para. 2 It. d) DSGVO. In this respect, reference should be made to the data protection statement of the defendant (Annex KIO), the paragraphs 6.1. for the right of access, 6.2. for the right of rectification, 6.3. for the right of erasure, 6.4. for the right of transfer - not referred to by the plaintiff - and 6.5. for the right of complaint.
c)
The plaintiff also has no claim against the defendant for an injunction to refrain from offering telemedia without providing users with information on the right of revocation or objection at the beginning of the usage process in accordance with Art. 7 para. 3 sentence 3 and Art. 21 para. 4 of the GDPR. A violation of these information requirements by the defendant is also not evident.
(1) According to Art. 7 para. 3 sentence 3 DSGVO, information must be provided about the possibility of revoking consent to data processing. The defendant's data protection statement contains this information in section 7. Insofar as the plaintiff objects that the information should have been provided in the cookie banner itself, so that there is a violation of Art. 13 para. 2 lit c) GDPR, the Board does not share this view. Such a link is not necessary to safeguard the user's rights and, moreover, is not practicable in view of the overall scope of the information to be provided. Moreover, the user does not expect to receive all information on data protection in a first display window, but to be able to call it up clearly arranged on a separate page. In this respect, the information in the privacy policy is sufficient.
(2) According to Art. 21(4) of the GDPR, the (general) right to object to the processing of personal data must be pointed out. The defendant's data protection statement contains this information in section 8.
3.
The plaintiff is entitled to an injunction against the defendant not to make the essence of the agreement between the joint controllers available to users in the event of joint responsibility for a data processing pursuant to Art. 26 para. I sentence I DSGVO, contrary to Art. 26 para. 2 sentence 2 DSGVO.
The defendant violated this obligation by transferring personal data to third-party cookies by integrating them and by the third-party providers (also) processing these data for their own purposes, as in the case of the integration of the "Google Analytics" cookie of the provider Google.
a)
Contrary to the view of the defendant, this is a joint responsibility for data processing within the meaning of Art. 26 GDPR and not a commissioned processing pursuant to Art. 28 GDPR.
According to the case law of the ECJ, the classification as a controller or processor always depends on the circumstances of the individual case (ECJ WRP 2018, 805 - Wirtschaftsakademie Schleswig-Holstein) and must be assessed on the basis of the criterion of the decision-making power over the purposes and means of the processing of personal data. Whether a decision-making power exists is measured by the extent to which the party involved has a concrete possibility to influence the data processing process, i.e. whether he can actively shape the process and bears responsibility for the processing. The ECJ considers the person who influences the data processing out of self-interest to be the controller (ECJ NZA 2018, 991 - Jehovah's Witnesses). This does not require an equal influence on the decision-making, so that the actual contribution to a decision can be structured differently. It is also not relevant how a contractual regulation describes the activity of those involved in data processing. Rather, what is decisive is how the intended and practised legal relationships present themselves in reality. What matters is the "actual influence" of the participants on the data processing operation (cf. BeckOK DatenschutzR/Spoerr, 32nd ed. 1.5.2020 marginal no. 13f, DS-GVO Art. 26 marginal no. 13c-13f with further references).
(2) In its argumentation, the plaintiff refers to the "Fashion ID" decision of the ECJ (see ECJ WRP 2019, 1146). The ECJ affirmed joint responsibility in the event that the operator of a website embeds a plugin which causes the browser of the visitor to the website to request content from this plugin and transmits personal data of the visitor to this provider for this purpose. In the case decided, an integrated plugin ("Like" button from Facebook) automatically transmitted the requested content to the website when the website was called up by the browser, transmitting the user's IP address and further technical data to Facebook. The ECJ considered Facebook's own responsibility and thus, as a result, a joint responsibility of the owner of the website and Facebook to be given, since the operator of the website has no influence on what information the browser transmits and what the third-party provider (Facebook) does with this data.
(3) In contrast, the defendant claims that when Google Analytics is integrated, the processing of the data is determined by the owner of the website, as itself. Google only processes the transmitted data according to the owner's specifications and makes the analysis results obtained available to the owner.
(4) However, this does not correspond to the actual circumstances. Google does not process the data solely for the purpose of use by the website operator. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes.
Accordingly, the data protection authorities of the Federation and the Länder have now also issued a corresponding assessment. In this respect, reference should also be made to the resolution of the Data Protection Conference of 12 May 2020 (cf. www.datenschutzkonferenz-onI i ne.de/medialdskb/20200526_beschluss_hinweise_zum_einsatz_von_googIe_analytics.pdf). It states:
"In the view of the data protection supervisory authorities, the processing in conjunction with the

Google Analytics is not a commissioned processing pursuant to Art. 28 of the GDPR. According to Art.
4 No. 7, Art 28 (10) DSGVO, the controller must determine the purposes and means of the processing itself. From this follows the obligation of the processor to process the data exclusively on the instructions of the controller (Art. 29 DSGVO). When using Google Analytics, the website operator does not determine the purposes and means of data processing alone. Rather, these are partly specified exclusively by Google, so that Google itself is responsible in this respect and contractually accepted by the website operator. The processing when using Google Analytics represents a uniform fact of life in which the various aspects of the processing only make sense as a whole. As a result, the parties involved within a processing activity cannot change their role as processor and/or controller. While Google continues to offer a contract for commissioned processing, it additionally clarifies in the "Google Measurement Controller-Controller Data Protection Terms" that Google and the user (website operator) are separately responsible for certain processing operations. Furthermore, Google clarifies in the terms of use that Google processes the data for its own purposes, in particular also for the purpose of providing its web analysis and tracking service. According to Article 28 (10) of the GDPR, Google is thus no longer a processor.
Taking into account the current case law of the ECJ, Google and the Google Analytics user are jointly responsible for the data processing, so that the requirements of Art. 26 DS-GVO must be observed."
4.
The plaintiff is entitled to a claim against the defendant for injunctive relief against the use of the clause:
"Advocado reserves the right to unilaterally amend these GTC - insofar as they are introduced into the contractual relationship with the customer - at any time, insofar as this is necessary to eliminate equivalence disruptions that arise subsequently or to adapt to changed legal or technical framework conditions and these do not unreasonably disadvantage the user. advocado shall inform the customer of any changes by e-mail, stating the content of the amended provisions. This e-mail shall contain the amended GTC as well as a reference to the right of objection, the objection period and its consequences in the event of failure to object. "
in its General Terms and Conditions pursuant to § I para. 1 UKlaG in conjunction with § 307 para. Section 307 (1) of the German Civil Code (BGB).
a)
The validity of a clause permitting an amendment of the General Terms and Conditions is to be examined on the basis of § 307 para. 1 BGB (cf. BeckOGK/Weiler, 1.6.2020, BGB § 308 no. 4, marginal no. 28 with further references; also: MüKoBGB/Wurmnest, 8th ed. 2019, BGB § 308 4, marginal no. 6 -for the case that amendment of the entire General Terms and Conditions also includes the (main) performance obligations). Pursuant to Section 307 (I) BGB, provisions in general terms and conditions are invalid if they unreasonably disadvantage the contractual partner of the user contrary to the requirements of good faith. An unreasonable disadvantage can also result from the provision not being clear and understandable.
Amendment clauses are permissible in principle. However, since they interfere with the legal principle dominating contract law, i.e. the binding of both contracting parties to the agreement made and the resulting possibility of amendment only by mutual consent, weighty reasons are required to justify them (fundamental: BGH NJW 1984, 1182). What is required are serious reasons - which cannot be influenced by the user - which lead to an unforeseeable change in the contractual equivalence relationship and therefore require a change, taking into account the interests of the contracting party. Thus, for foreseeable changes in the contractual circumstances, an amendment of the GTC via an amendment clause is excluded. An amendment clause is also inadmissible for those cases in which the law contains a provision for the case of a change of the contractual structure (BeckOGK/Zschieschack, 1.9.2020, BGB § 307 Änderungungs- und Anpassungsklausel, marginal no. 17).
b)
In the present case, there is already no restriction of the reasons for an amendment to reasons that cannot be influenced by the defendant as user. This is because the right of amendment is also intended to exist in order to be able to make adjustments to changed technical framework conditions. Apart from the fact that it is clear to the customer which general conditions are meant and which changes can fall under them, these changes can (also) be triggered by the defendant itself. This is because the defendant determines on which technical platform and which technologies it provides its services. However, it cannot be ruled out that it is precisely these changes that make it necessary to adapt the GTC because they no longer "fit". However, this very possibility should not exist.
The plaintiff has a claim against the defendant for reimbursement of the warning costs pursuant to § 5
UKlaG in conjunction with. Section 12 (I) sentence 2 UWG. Insofar as the warning - in accordance with the above - went too far in part, this does not affect the fundamental justification of the claim or the amount of the warning costs. The warning costs of EUR 214.00 are not dependent on the value in dispute and are also not objectionable with regard to the justified warning.
IV.
The decision on costs is made pursuant to § 92 (1) ZPO. The plaintiff's partial defeat with regard to part of the application under 2. is to be valued at EUR 2,500.00. The decision on provisional enforceability follows from § 709 ZPO and § 708 no. 11, 711 ZPO.
The amount in dispute is determined in accordance with § 3 ZPO, whereby the claims 1 - 3 are to be valued at EUR 5,000.00 each and the claim 4 with regard to the general terms and conditions clause at EUR 2,500.00.
Remedies:
An appeal may be lodged against the decision. The appeal is only admissible if the value of the subject matter of the appeal exceeds 600 euros or if the court of first instance has allowed the appeal in the judgment.
The appeal shall be lodged within an emergency period of one month with the
Rostock Higher Regional Court
Wallstraße 3
18055 Rostock.
The time limit begins with the service of the complete decision, at the latest with the expiry of five months after the delivery of the decision.
The notice of appeal must be filed by a lawyer. The notice of appeal must contain the name of the contested decision and a statement that an appeal is being lodged.
The appeal must be substantiated within two months in a lawyer's brief. This period also begins with the delivery of the complete decision.
An appeal may be lodged against the decision fixing the amount in dispute if the value of the subject-matter of the appeal exceeds 200 euros or if the court has allowed the appeal.
The complaint shall be lodged within six months with the
Rostock District Court
August-Bebel-Straße 15 - 20 18055 Rostock
to insert.
The time limit begins with the entry into force of the decision on the merits or the other settlement of the proceedings. If the amount in dispute has been determined later than one month before expiry of the six-month period, the appeal may still be filed within one month after service or informal notification of the determination decision. In the case of informal notification, the order shall be deemed to have been notified on the third day after posting.
The appeal shall be filed in writing or by declaration on the record at the registry of the aforementioned court. It may also be lodged before the registry of any Local Court; however, the time limit shall only be observed if the record is received by the above-mentioned court in due time. The participation of a lawyer is not required.
Appeals may also be submitted as an electronic document. A simple e-mail does not meet the legal requirements.
The electronic document must bear a qualified electronic signature of the responsible person or be signed by the responsible person and submitted by a secure means of transmission .
An electronic document bearing a qualified electronic signature of the person responsible may be transmitted as follows: by secure means of transmission or ) of the court established for the receipt of electronic documents.
With regard to secure means of transmission, reference is made to S 130a (4) of the Code of Civil Procedure. With regard to the further requirements for electronic communication with the courts, reference is made to the Ordinance on the Technical Framework Conditions for Electronic Legal Transactions and on the Electronic Communication System.
-
(Elektronischer-Rechtsverkehr-Verordnung - ERVV) as amended from time to time and to the website www.justiz.de.
Vice President of the District Court
Certified
Rostock, 15.09.2020
Judicial staff
Document signed by: Justice
Mecklenburg-Western Pomerania on: 15.09.2020 11:54
"g n.zW

@@ Line 77: / Line 77: @@
 |Appeal_From_Status=
 |Appeal_From_Link=
-|Appeal_To_Body=OLG Rostock
+|Appeal_To_Body=OLG Rostock (Germany)
 |Appeal_To_Case_Number_Name=unknown
 |Appeal_To_Status=Pending appeal
@@ Line 86: / Line 86: @@
 }}
-The LG Rostock held that tracking cookies can only be placed with the user's active consent. A preset permission that is only to be confirmed via an "OK" button is not sufficient. The controller appealed, the decision is not (yet) in force.
+The regional court of Rostock (LG Rostock) held that tracking cookies can only be placed with the user's active consent. A preset permission that is only to be confirmed via an "OK" button is not sufficient.
+Further, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google.
+The controller appealed, the decision is not (yet) in force.
 ==English Summary==
 ===Facts===
-The German consumer organisation ''Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V.'' (vzbv, the claimant) filed a lawsuit against ''advocado GmbH'' (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with preticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries.
+The German consumer organisation ''Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V.'' (vzbv, the claimant) filed a lawsuit against ''advocado GmbH'' (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries.
-The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendent had violated Articles 5(1)(a), 13/14 and 26 GDPR as it had failed to properly inform users of the scope of intended processing activities and joint controllers in connection with the use of cookies.
+The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies.
-The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019. Afterwards, the defendent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors.
+The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its [[CJEU - C-673/17 - Planet49|decision C-673/17 on 01.10.2019 ("Planet 49")]]. Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors.
-(Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be disussed further in this summary.)
+(Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.)
 ===Dispute===
-*Was it neccessary to ask for the users' consent under Artilce 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)?
+*Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)?
 *Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR?
-*Did the defendant violate GDPR provsions on tranparency?
+*Did the defendant violate GDPR provisions on transparency?
 *Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers?
 ===Holding===
-The court held that the marketing and analytics cookies used by the defendant can only be placed with the users's consent under Article 6(1)(a) GDPR: these cookies could not be considered
+====Legal basis and validity of consent====
+The court held that the <u>marketing and analytics cookies</u> used by the defendant c<u>an only be placed with the users' consent under Article 6(1)(a) GDPR</u>: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons.
+Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid.
-aking into consideration the CJEU's ruling
+====Transparency====
+The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies.
+====Sole or joint controllership when using Google Analytics?====
+Lastly, the court held that the use of <u>Google Analytics results in joint controllership of the website provider using this tool and Google</u>. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the [https://www.datenschutzkonferenz-online.de/media/dskb/20200526_beschluss_hinweise_zum_einsatz_von_google_analytics.pdf official opinion of the "Datenschutzkonferenz"], a gathering of all German DPAs.
 ==Comment==
-Please note that the decision is not (yet) in force, as the controller filed an appeal with the OLG Rostock at which the case is now pending. Therefore the decision is not officially published but only presented on the plaintiff's website, where one can download the (redacted) decision. Once the OLG Rostock has issued its decision, it will be linked here.
+Please note that the decision is not (yet) in force, as the controller filed an appeal with the OLG Rostock at which the case is now pending. Therefore, the decision is not officially published but only presented on the plaintiff's website, where one can download the (redacted) decision. Once the OLG Rostock has issued its decision, it will be linked here.
 ==Further Resources==