VG Weimar - 3 K 1832/20 We

VG Weimar - 3 K 1832/20 We
Court:	VG Weimar (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 80 GDPR
Decided:	13.04.2022
Published:
Parties:	Commissioner for Data Protection and Information Security of the State Thüringen
National Case Number/Name:	3 K 1832/20 We
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	OpenJur (in German)
Initial Contributor:	Sara Horvat

The data subject exercised their right to mandate an organisation to lodge a complaint in their name under Article 80 GDPR. A similar right is also found in the national law, with the difference that it also allows to stand as a litigant.

English Summary

Facts

The data subject exercised their right to mandate an organisation to lodge a complaint in their name under Article 80 GDPR. A similar right is also found in the national law, with the difference that it also allows to stand as a litigant.

Holding

From a procedural point of view, Article 80(1) GDPR does not establish the right to stand as a litigant, but the power to bring a complaint or court proceedings on behalf of the data subject.

Thus, while the authorised representative Art. 80 GDPR is authorised to represent within the meaning of the GDPR, it would have to be rejected pursuant to § 67 (3) sentence 1 VwGO (AdministrationCourt Code) in the absence of the requirements of the enumerative catalogue (Numerus Clausus) of § 67 (2) sentence 2 VwGO. The mentioned provisions of the Administration Court Code define exactly which Institutions can be litigators in court and legally represent someone, the organisation could bring Act in the name of the data subject under in the proceedings held upon GDPR (ex. filing in a complaint at the national DPA), but in procedures which are regulated in national law, could not be signed as a litigant for someone else.

Due to the procedural failure, the court dismissed the appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

tenor

1. The lawsuit is dismissed.

2. The plaintiff has to bear the costs of the legal dispute.

3. The judgment is provisionally enforceable because of the costs. The plaintiff is waived to avert enforcement by deposit or security of 110% of the amount to be recovered unless the defendant posts security of the same amount prior to enforcement.
facts

The plaintiff objects to the final notification of November 24, 2020 issued by the State Commissioner for Data Protection and Freedom of Information (defendant) as part of a complaints procedure.

The plaintiff is a party to a family law proceeding before the District Court of Jena (Az.: 40 F 44/19). As part of the legal dispute there about parental custody, the lawyer ... T..., ....-...-Straße ... in ... J... was dismissed by decision of the District Court of Jena on February 4th 2019 appointed legal counsel for the two daughters of the plaintiff. In carrying out this activity, he held talks with both children, the plaintiff, the child's father and various social agencies (youth welfare office, etc.). As part of his reporting, he presented the district court with the complete e-mail correspondence between himself and the plaintiff in several cases and described the content of the conversations held with her. (On the content of the decision, the e-mail correspondence and the discussions, sheet 56 ff., 141 f. of the administrative files, sheet 31 ff., 43 ff., 47 ff., 51 ff., 54 ff. and 58 ff . the court record is referenced.)

On February 9, 2020, the plaintiff turned to the defendant with a complaint and complained about the forwarding of the e-mail traffic and the disclosure of personal data in the context of the family court proceedings by lawyer T.... She explained in support of her complaint that that the Respondent breached his duty of confidentiality by incorrectly and unlawfully processing or disclosing your data.

In a letter dated February 26, 2020, the defendant finally asked the respondent for information regarding the data protection violation in question. In a letter dated March 18, 2020, the latter commented that the disclosure of the plaintiff's data was covered by his powers and obligations as procedural counsel , 9 Para. 2 lit. f Alt. 1 of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive No . 95/46/EG - General Data Protection Regulation - DS-GVO - in conjunction with Section 158 of the Act on Procedure in Family Matters and in Matters of Voluntary Jurisdiction - FamFG - in the context of his special activity.

With a decision dated November 24, 2020, which was served on the plaintiff on November 27, 2020, the defendant informed that the proceedings initiated as a result of the complaint had been completed. The complaint was dismissed as unfounded. For the justification of the decision, reference is made to its content.

The plaintiff, represented by an association within the meaning of Art. 80 GDPR, lodged a complaint with the Weimar Administrative Court in a letter dated December 28, 2020.

The complaint was initially received electronically by the administrative court on December 28, 2020 at 9:18 p.m. The test log for signed attachments had shown that the status of the signature was undetermined because at least one necessary check could not be carried out or had delivered an undetermined result. In addition, the statement of claim had also been filed by fax. In the period from December 28, 2020, 8:45 p.m. to 10:44 p.m., five transmission attempts were made to the number #31036..., all of which ended with an error report ("Busy/No Signal"). No page of the complaint had been submitted. On December 29, 2020, two more fax attempts were made to number #49361... at 1:30 a.m. and 8:24 p.m., which ultimately resulted in a ten-page complaint being sent to the court. (In this respect, reference is made to the test report and the fax reports, pages 60 ff. and 95 ff.)

In support of her claim, the plaintiff argues that the final decision of the defendant is based on an incorrect assessment. He did not adequately assess the facts and included legally incomplete considerations in his assessment. The legal basis for the finding that the processing of the personal data by the respondent was legitimate appears to be unsuitable for this. Rather, a right to remedy arises from the interpretation of the case law of the European Court of Justice - ECJ - and the stated recitals . Finally, the DS-GVO should not be used as the legal basis for an authorization or a legal basis, because in this respect the principle of materiality is violated by the intervention in Article 2 Paragraph 1 in conjunction with Article 1 Paragraph 1 of the Basic Law - GG.

The lawsuit was also received in good time. The fact that the fax recipient of the court was busy or without a signal on December 28, 2020 is attributable to his sphere, so that in any case she cannot be at fault for any delay.

In the oral hearing on April 13, 2022, the plaintiff provided further information on her lawsuit.

In addition, she argues that Art. 80 e.V. can be represented in a permissible manner in the context of the local proceedings under European law, which is decisive. In addition, the area code "*#31" in the fax is not the Dutch area code, but a control character of the fax system of your legal representative. This control sign does not perform any function that impairs the transmission process, so that the error in the transmission can still be attributed to the sphere of the court.

The plaintiff now requests

to oblige the defendant, repealing the decision of November 24, 2020, to re-decide on the complaint in compliance with the court.

The defendant requests

reject the complaint.

He explains that the content and scope of the appointment of a procedural adviser is clearly determined by law in such a way that there is the authority to pass on the information to the district court that commissioned it. The principle of necessity alone establishes an outer limit to the transfer of data (here: all data that are no longer relevant or necessary to protect the interests of the child). Otherwise, the manner of collection is at the dutiful discretion of the procedural adviser. Furthermore, the action is already inadmissible. The collection by electronic mail does not correspond to the formal requirements that are to be placed on a qualified or simple signature. The late receipt by fax was to be attributed to the plaintiff.

The court informed the plaintiff of doubts about the formal validity of the electronic submission and a possible time limit for the action by the receipt of the fax on December 29, 2020 with letters dated December 30, 2020 and January 20, 2021 and gave her the opportunity to comment within given within one or two months.

For further details of the facts and the dispute, reference is made to the content of the court file (one volume) and to the administrative files submitted by the defendant (Az.: 199-7/2020.19, one staple - 240 pages). The files were all the subject of the decision-making process and the oral hearing.
reasons

The lawsuit is unsuccessful because it is inadmissible.

I. First of all, it can be stated that Art.

1. In addition to the possibility specifically mentioned in Section 67 (2) sentence 2 no. 6 VwGO of being represented by an association, Art both norms appear.

According to Art. 80 Para. 1 DS-GVO, a data subject has the right to contact a non-profit institution, organization or association duly established under the law of a Member State, whose statutory objectives are in the public interest and which are in the area of protection of Rights and freedoms of data subjects in relation to the protection of their personal data, to authorize them to lodge a complaint on their behalf, to exercise on their behalf the rights referred to in Articles 77, 78 and 79 and the right to compensation under Article 82 to claim something. Art. 80 para. 1 GDPR is initially based on the data subject and his substantive rights, which he can procedurally exercise through certain organizations. In terms of procedural aspects, the wording of Art. 80 (1) GDPR does not justify a legal process, but rather the authority to lodge a complaint or court proceedings for the person concerned on behalf of a third party (see, inter alia, Werkmeister in: Gola, General Data Protection Regulation, 2nd edition 2018, Art. 80 para. 8). Art. 80 Para. 1 DS-GVO thus causes an extension of the procedural representation rule. However, this results in a systematic contradiction to the substantive provision of § 67 Para. 2 VwGO, the wording of which does not expressly provide for procedural assistance - in the form set out in Art. 80 Para. 1 DS-GVO. In particular, § 67 Para. 2 Sentence 2 No. 6 VwGO is not relevant in this case, since the plaintiff's representative is an association, whose statutory tasks do not essentially include the joint representation of interests, the advice and representation of the beneficiaries according to the social compensation law or the includes disabled people and which, taking into account the type and scope of its activities and its membership, does not offer the cumulatively necessary guarantee for competent legal representation, to work for its members in matters of welfare for war victims and severely disabled person law and related matters. 80 e.V. is authorized to represent within the meaning of the GDPR, he would therefore be rejected in the absence of the requirements of the enumerative catalog of § 67 (2) sentence 2 VwGO according to § 67 (3) sentence 1 VwGO.

2. A systematic interpretation of Art. 80 DS-GVO, however, comes to the conclusion that the tension between Art. 80 Para. 1 DS-GVO and Section 67 Para -GMO an application priority is to be granted here.

The completion of the instruments for enforcing the GDPR by organizations depends on the structure of the member state law (cf. Schantz in: Schantz/Wolff DatenschutzR, para. 1273). On the one hand, this applies to the possibility of having claims for damages asserted (paragraph 1) and, on the other hand, to the association's right to complain or take legal action as such (cf. Frenzel in: Paal/Pauly, 3rd edition 2021, DS-GVO , Art. 80 para. 13). In Germany, the DS-GVO therefore applies to the existing regulations (§§ 1, 2 law on injunctive relief in consumer rights and other violations, §§ 3a paragraph 1, 8 law against unfair competition). These must be measured against the claim of Art. 80 (2) GDPR (cf. Paal/Pauly/Frenzel, 3rd edition 2021, GDPR Art. 80 para. 13). This view is generally recognized and follows from the reference in Art. 80 Para. 1 Hs. 2 DS-GVO ("[...] provided that this is provided for in the law of the member states."), which in any case also refers to the last variant of sentence 1 ("[...] and to claim the right to damages in accordance with Article 82, [...]").

However, it is questionable to what extent the last half-sentence of Art. 80 Para. 1 DS-GVO refers to the entire provision or only to the last variant of sentence 1. Because when referring to the entire provision, the priority of application of the VwGO remains as a national one Law of a member state, so that a power of representation in the absence of the requirements of § 67 VwGO is out of the question. If the last half-sentence only refers to the right to claim damages, the DS-GVO extends the scope of § 67 VwGO, which was previously considered final. The interpretation of the half-sentence is therefore decisive for the scope of Art. 80 Para. 1 DS-GVO.

The court is of the opinion that the reservation of national law provided for in the last half-sentence of Art. 80 (1) GDPR only relates to the representational assertion of damages under Art. 82 GDPR.

The wording of the demonstrative pronoun "this" speaks for this. Due to the origin of the GDPR in European law, it also seems necessary to use versions of the European regulation in other languages to interpret the wording. This is Article 80 of Regulation (EU) No. 2016/679 of the European Parliament in English1REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 - L119/1 4.5.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeating Directive 95/46/EC (General Data Protection Regulation)REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 - L119/1 4.5.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeating Directive 95/46/EC (General Data Protection Regulation) as follows:

Article 80 Representation of data subjects

1. The data subject shall have the right to mandate a not-for-profit body, organization or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf , and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.[...]

The sentence structure makes it clear that, on the one hand, there is the possibility of commissioning an association that administers the rights mentioned in Articles 77, 78 and 79 on behalf of others ("[...] to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, [...]") and, on the other hand, the right to damages, provided that this right is provided for in the law of the Member States, which is to be considered separately from this overall ("[.. .] and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.").

Above all, the exclusive reference of the last half-sentence only to the penultimate one speaks of the sense and purpose of the relevant norm. Art. 80 DS-GVO is intended to give data subjects the opportunity not to enforce the rights to which they are entitled themselves or through a lawyer, but to commission certain institutions that work in the public interest to do so (cf. Kreße in: Sydow, European General Data Protection Regulation, 2nd edition 2018, GDPR, Art. 80 para. 1). This is intended to make it easier for those affected to exercise their rights and ensure the specific protection of their interests (cf. Schatz, The General Data Protection Regulation, NJW 2016, 1841 [1847] and Karg in: Wolff/Brink, BeckOK data protection law, as of: November 2021, GDPR, Art. 80 para. 6). Insofar as representation by an association within the meaning of Art. 80 (1) GDPR would be excluded per se in a simple procedure without the obligation to have a lawyer stipulated by the member state, the provision would be in vain and would miss its purpose. The institutions referred to in Art. 80 (1) GDPR would then no longer be able to enforce certain rights of natural persons in the public interest independently of a specific mandate, which would paralyze the effectiveness of the data protection regulations overall. The expansion of collective legal protection in data protection law intended by the standard would be weakened and the implementation deficit criticized by consumer protection associations would continue to exist.

The court does not systematically ignore the fact that, with regard to legal action pursuant to Art. 78 and Art. 79 GDPR, the law does not provide that the organization can lodge an appeal on behalf of the person concerned, but only that they can exercise their rights can perceive. In contrast to the complaint, Art. 80 (1) GDPR only grants the association a right of representation at a higher level of abstraction. So it remains unclear whether the legislature actually wanted to make a substantive distinction with the different wording - Art. 77 DS-GVO is also listed in the "rights to be exercised" - after all. However, based on the wording and rationale of Art. 80 GDPR, it can be stated that paragraph 1 does not prohibit national representation requirements in court, so that a compulsory lawyer provided for in the rules of procedure remains permissible (cf. Moos/Schefzig in: Taeger/Gabel, DS-GVO, 3rd edition 2019, Art. 80 marginal number 16 and Bergt in: Kühling/Buchner, loc.cit. marginal number 11c with further references). In line with this, the rationale of wanting to regulate a comprehensive postulation capability speaks in favor of an opening clause for the Member States only with regard to the assertion of claims for damages, not with regard to legal remedies under Art. 78 and Art. 79 DS-GVO (cf. also Kreße in: Kühling/Buchner/Bergt, 3rd edition 2020, GDPR Art thus also authorized to represent in court, but not in legal proceedings, cf. Kreße in: Kühling/Buchner/Bergt, loc.cit. with further references]). As a European regulation, the GDPR itself is directly applicable law in the member states. This gives it priority over any member state law (cf. Art. 288 Treaty on the Functioning of the European Union, Art. 99 Para. 5 DS-GVO, § 1 Federal Data Protection Act). The primacy of Union law not only means that conflicting national law is inapplicable, but also that the courts are obliged to interpret national law in conformity with Union law.

After all, it can be stated that the right of representation under Art. 80 DS-GVO is in vain, insofar as national procedural law - such as here § 67 Para. 2 VwGO - certain organizations within the meaning of Art. 80 DS-GVO from representation in court basically excludes (a.A. VG Wiesbaden, judgment of May 05, 2021, Az.: 6 K 60/21.WI, para. 22 - quoted from juris). Relying on national procedural law would in fact lead to the deletion of the right to sue. The possibility of entrusting institutions with the exercise of the rights under Art. 77-79 DS-GVO cannot be restricted by the Member States, so that the institutions referred to in Art. 80 DS-GVO can be postulated in this respect by virtue of Union law and § 67 para 2 Sentence 2 No. 6 VwGO in relation to Art. 80 Para.

Consequently, the plaintiff's legal representative under Art. 80 e.V. was not to be rejected during the present proceedings.

3. In all other respects, the complaint is permissible as a pure obligation action pursuant to Section 42 (1) VwGO, because the plaintiff requests that the defendant intervene against the respondent. Insofar as the plaintiff asserts a claim for a decision by the competent supervisory authority free of discretionary errors, it also has an effective legal remedy against the final decision of the defendant under Article 47 of the Charter of Fundamental Rights of the European Union in conjunction with Articles 77 (1) and 78 (1) GDPR to (cf. VG Wiesbaden, decision of August 31, 2021, Az.: 6 K 226/21.WI, para. 92 - quoted from juris). The decision of the defendant not to intervene in favor of the plaintiff against the respondent is an administrative act within the meaning of Section 35 (1) ThürVwVfG. The plaintiff, as the owner of a potential right to intervention by the defendant, is also entitled to sue within the meaning of Section 42 (2) VwGO.

In this respect, there is no room for classifying the application as a partial action for failure to act. A necessary prerequisite for the action for failure to act according to § 75 VwGO is the absence of a "factual" decision by the exit or objection authority. A substantive decision is any binding official decision on the main issue (cf. Prosch in: Schoch/Schneider, VwGO, as of: July 2021, § 75 marginal number 5a). With the disputed decision of November 24, 2020, there is a substantive decision on the matter. The mere fact that the defendant did not respond to all of the concerns presented by the plaintiff in accordance with the ideas of the plaintiff cannot preclude a substantive decision as detrimental. The incorrectness of the discretionary considerations of the defendant, also in the form of a partial non-consideration of the argument, is the subject of the obligation action brought by it in the form of the counterclaim for refusal.

II. However, the action is inadmissible because it was not received within the one-month period (Section 74 (1) sentence 2 in conjunction with (2) VwGO).

The plaintiff was served with the decision with proper information on legal remedies on November 27, 2020.

1. The delivery to the plaintiff's attorney-in-fact was incorrect, because the delivery by acknowledgment of receipt is reserved for the parties to the proceedings named in § 5 Para. 3 Thuringia's Administrative Delivery and Enforcement Act - ThürVwZVG. In accordance with § 3 para. 1 ThürVwZVG, the legal representative as an association was to be served only by postal delivery document (or by registered mail in accordance with § 4 para. 1 ThürVwZVG). However, the incorrect delivery of the defendant could be cured according to § 9 Alt. 2 ThürVwZVG. If the notification has been received in violation of mandatory service provisions, it is deemed to have been served at the time it actually reached the person entitled to receive it. The plaintiff's attorney-in-fact sent back his acknowledgment of receipt to the defendant dated November 27, 2020 (page 187 of the administrative file). Thus, the prerequisites for the healing of the delivery defect are given.

Due to the service on November 27, 2020, the period for filing an action ended on December 28, 2021 in accordance with Section 57 (2) VwGO in conjunction with Section 222 (2) Code of Civil Procedure - ZPO - in conjunction with Sections 187 (1), 188 (2) civil matters Code of Laws - BGB -. (December 27, 2020 was a Sunday.)

1. The collection by electronic transmission on December 28, 2020 is not relevant because it did not meet the requirements of Section 55a VwGO.

The prerequisite is transmission by simple signature and secure transmission path or the existence of a qualified signature. On the one hand, the lawsuit was not forwarded to the court via a secure transmission path within the meaning of Section 55a (4) No. 1 to 6 VwGO (here: simple electronic transmission of a pdf file). On the other hand, there is a lack of a qualified signature within the meaning of Section 55a (3) sentence 1 VwGO. This requires, among other things, that the requirements of Article 32 (1) (b) of Regulation (EU) No. 910/2014 are met and that these are subject to a certified inspection in accordance with the requirements of Annex I of Regulation (EU) No. 910/2014 are accessible. In the present case, according to the audit report of December 28, 2020 (page 60 et seq. of the court file), such a review could not be carried out. This came to the conclusion that the status of the signature was undetermined and at least one necessary check could not be carried out or had delivered an undetermined result. There was therefore no verifiable signature at the time of electronic receipt.

2. For this reason, it depends on the filing of the complaint by fax (§ 81 Para. 1 Sentence 1 VwGO).

The full statement of claim was not received by the court until December 29, 2020. The transmission attempts within the deadline of December 28, 2020 failed, as evidenced by the error message "Busy/No Signal".

However, the failed transmission is to be assigned to the plaintiff's sphere. This occurs regardless of whether the entry of "*#31" is the area code for the Netherlands or - as the plaintiff claims - a fax system-related control character of her attorney-in-fact. According to the fax report dated December 28, 2020, the fax machine at the administrative court in Weimar worked properly for all fax transmissions (8:16 a.m. to 10:11 p.m.) without errors. Only the fax attempts by the plaintiff's attorney-in-fact failed. The court considers the fact that the transmission was finally successful after changing the number by entering "#49" to be particularly meaningful when assigning the error in their sphere (cf. change of number at 00:45 on December 29, 2020 , according to a fax report - reference is made to sheet 97 of the court file). The use of an obviously incorrect fax system-related control character and the associated risk of non-transmission are therefore exclusively attributable to the plaintiff. The plaintiff must accept responsibility for the fault of her legal representative (section 85 (2) of the Code of Civil Procedure - ZPO - in conjunction with section 173 sentence 1 of the VwGO).

III. The cost decision is based on Section 154 (1) VwGO.

The decision on the provisional enforceability of the judgment due to the costs and the right to avert follow from § 167 VwGO in conjunction with §§ 708 No. 11, 711 ZPO.

The appeal to the Thuringian Higher Administrative Court was not allowed because there was no reason for the admission according to Section 124 (2) No. 3 or No. 4 VwGO in conjunction with Section 124a (1) sentence 1 VwGO.

decision

The value of the disputed item is set at €5,000.00 (Section 52 (2) of the Court Costs Act).
footnotes

1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 - L119/1 4.5.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeating Directive 95/46/EC (General Data Protection Regulation)
Permalink: https://openjur.de/u/2448197.html (https://oj.is/2448197)