OLG Linz - 6R49/19x

OLG Linz - 6 R 49/19x
Court:	OLG Linz (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 2(1) GDPR Article 4(2) GDPR Article 4(7) GDPR Article 4(8) GDPR Article 82 GDPR § 4(1) DSG (Austrian Data Protection Act) § 69(4) DSG (Austrian Data Protection Act) § 78 UrhG (Urheberrechtsgesetz - Austrian Copyright Act)
Decided:	12.06.2019
Published:	04.06.2020
Parties:	unknown (private person) unknown (Austrian company)
National Case Number/Name:	6 R 49/19x
European Case Law Identifier:	ECLI:AT:OLG0459:2019:00600R00049.19X.0612.000
Appeal from:	Landesgericht Linz 36 Cg 1/18x-16
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	n/a

The Higher Regional Court of Linz (Austria) dismissed a data subject's claim for damages (EUR 20,000) for the publication of the claimant's photographs without his consent on the website of a Greek clinic, as the publication of the photographs could not be attributed to the defendant.

English Summary

Facts

In June 2017, a Greek medical doctor working for a Greek clinic performed a hair transplant on the claimant. Shortly after, the claimant lost his hair even in places that were not affected by the surgery. His hair only regrew months later.

In the course of the claimant's stay in Greece, both the doctor and employees of the Greek clinic had taken picture of the claimant - even during the surgery. These pictures were published on the Greek clinic's website, together with the claimant's name. The claimant had not consented to this processing of personal data and requested the removal of the photographs and his other personal data. A dispute ensued between the claimant and the doctor (the defendant).

Dispute

The claimant requested a) repayment of the remuneration paid to the defendant of EUR 5,880 and b) damages of EUR 20,000 for the photographs published on the Internet.

The defendant argued that the surgery had been performed lege artis and that the photographs had been published by the Greek clinic without the defendant's knowledge and had been removed immediately after the claimant's request. As there was no economic or personal interdependence between the Greek clinic and the defendant, the defendant should not be liable for any damages occurred.

Holding

The OLG Linz dismissed the appeal (which only concerned the claim for damages) and upheld the decision of the Landesgericht Linz which had dismissed the claim.

The unauthorised action of employees of the Greek clinic to put the claimant's name on the photographs and to publish them on the internet without his consent constituted an interference that was unforeseeable for the defendant.

As a result, under Article 82(3) the defendant cannot be held responsible for the processing of the claimant's personal data by the Greek clinic.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

ON BEHALF OF THE REPUBLIC
The Higher Regional Court of Linz, as the court of appeal, has been appointed by Judge Bernhard Telfser as chairman and Judges Sabine Plöckinger and Sabine Plöckinger. Edeltraud Kraupa in the case of the plaintiff K***** P*****, managing director, *****, *****, represented by HASCH & PARTNER Anwaltsgesellschaft mbH in Linz, against the defendant B***** GmbH & Co KG, *****, *****, represented by Nowotny & Wohlmacher Rechtsanwälte OG in Linz, for EUR 25,880.00 s.A., on the plaintiff's appeal against the judgment of the Regional Court of Linz of 27 February 2019, 36 Cg 1/18x-16, in non-public session rightly recognized
The appeal is not granted.
Orders the applicant to pay to the defendant the costs of the appeal, assessed at EUR 2 286,72 (including EUR 381,12 VAT), within 14 days
The ordinary audit is permissible.
REASONS FOR DECISION:
P***** F*****, hairdresser and friend of the plaintiff, suggested a hair transplant at the defendant party. The procedure itself is performed at B*****, a company under Greek law in Greece. The defendant limits itself to advising and mediating the clients and providing aftercare, including medical care. No other economic or personal links between the defendant and B***** can be established. 
On May 31, 2017, P***** F***** and the plaintiff first entered into a medical 
Linz Higher Regional Court
Take a medical history sheet and the pre- and post-operative instructions each from B***** and fill it in. P***** F***** explained the procedure to the plaintiff, including that he must expect the face to swell and that it may take a few days for the stitches in the scalp to heal. He did not inform the plaintiff about any other possible side effects. Subsequently, the plaintiff and P***** F***** signed the contract for the hair transplant for the defendant. In point 1. it is stated that the plaintiff instructs the defendant party to carry out an own hair transplantation at B*****, as well as that the pre- and aftercare is included in the transplantation package. 
Subsequently, P***** F***** agreed with the authorised signatory of the defendant party on the 
surgery appointment, booked the flights to Athens and sent the signed 
Clarification forms both on the defendant party to Germany and on B***** to Greece. Since the plaintiff was to take up a new position as managing director on September 1, 2017, which he had been promised in May 2017, P***** F***** tried to find a date as soon as possible.
The surgical procedure was performed on 6 June 2017 and some time after the operation, the 
Plaintiff suddenly started to lose hair on the right and also on the left side above the ears in places that were not affected by the operation at all. The reason for this cannot be determined, it is neither a common nor a foreseeable side effect. Such a thing had never happened before. However, it is common for the transplanted hair to fall out first before it grows again in the new areas. It was reported that a hair cycle lasts three months, and various products were tried out on the instructions of the Greek doctor. As of July 10, 2017, the plaintiff received weekly treatment at P***** F*****. Despite this, no success was achieved at first, which is why the physician treating the plaintiff in Greece came to Linz on August 10, 2017 at the instigation of the defendant's authorized representative. At another business partner of the P***** F*****, the plaintiff was then injected with his own blood into the scalp at those places where the hair had fallen out. Thereafter, the treatment of P***** F***** was continued for the time being. Since a toupee, which had been adjusted in the meantime by the defendant's authorized signatory, partially slipped, the plaintiff wore a cap most of the time.
In the course of the plaintiff's stay in Greece, photographs of the plaintiff were taken by P***** F***** and B***** employees, including during the operation, and subsequently published on their website by a B***** employee together with other pictures, including a selfie of the plaintiff, with the plaintiff's real name. The accompanying text was written in Greek. The plaintiff had not given his consent to a possible publication, rather he expressly stated that he did not wish this. So when two of his employees asked him that they now knew why he was wearing a cap, he fell out of the clouds. Although an immediate attempt was made to delete the pictures or the article, it took about a month before they could no longer be found on the Internet. 
After the defendant was served with the letter of formal notice of 13 September 2017 from the claimant's representative, the defendant instructed P***** F***** not to carry out any further follow-up treatment. As of September 8, 2017, the plaintiff's hair began to grow again and by November 2017 it was approximately 1 cm long. At the same time, the hair grew back in those areas that were not affected by the operation. At the end of the trial, the plaintiff is satisfied with the result of the transplantation of his own hair. The treatment was ultimately successful. The fact that the plaintiff was promised that the current appearance would be given after only a few weeks, cannot be determined. 
With the present action, the plaintiff is seeking, on the one hand, repayment of the remuneration paid of EUR 5,880.00 and, on the other, damages in the amount of EUR 20,000.00 for the recordings published on the Internet. The treatment had not been performed lege artis. If he had been properly informed that hair on the entire head could fall out massively in places as a possible side effect, he would not have carried out the treatment. He was entitled to withdraw from the contract and to rescind the contract because the defendant party had rejected the contractually agreed aftercare as a measure of improvement. In this respect, the claim of EUR 5,880.00 is based on warranty and compensation law and any other legal basis. 
By the inadmissible publication of the photos showing the plaintiff and bearing his name, the defendant infringed Sec. 33 of the German Data Protection Act (DSG) as well as Sec. 78 of the Copyright Act. The published pictures were sensitive data concerning the most personal sphere of life, the private and intimate sphere and health. The publication would violate secrecy interests worthy of protection in a way that would be tantamount to a suitability for exposure under § 7.1 MedienG. Pursuant to § 7.1 MedienG, the person concerned was entitled to compensation for the offence suffered to a maximum amount of 
EUR 20,000.00 if his highly personal sphere of life is presented in a medium in a way that is suitable to expose him in public. In addition, the good reputation of the plaintiff pursuant to § 1330 of the Civil Code and the protection of portraits pursuant to § 78 of the Copyright Act had also been infringed; for the offence suffered, he was therefore entitled to appropriate compensation to the maximum amount, i.e. EUR 20,000.00. On account of the penal provisions of the DSGVO, this amount was in any event appropriate.
The defendant denied, applied for dismissal of the action and argued that both the hair transplantation and the aftercare had been carried out lege artis. The defendant was not obliged to provide prior information about the unforeseeable side effects of hair loss in places not affected by the transplantation. Since the plaintiff again had corresponding hair, the contract had been fulfilled, so that a claim for repayment of the remuneration paid was not justified. The photos were published without their knowledge and without any action on their part and were immediately deleted upon request by the plaintiff. As there is no economic or personal interrelation between the clinic operator and her, there is a lack of passive legitimation. Since the treatment contract does not include the taking of photographs or their online placement, there is no internal connection between the fulfilment of the contract and the possibly damaging action of the clinic operator. Nor had she been the client for the use of data. The claimed amount was excessive.
By the contested judgment, the Court of First Instance dismissed the application. His 
It based its decision on the findings set out on pages 1 and 2 to 5 of its judgment, to which reference is made under Section 500a of the Code of Civil Procedure and which are summarised at the beginning of this document. 
In its legal assessment, it denied the claim for repayment of the remuneration paid with a missing warranty claim. If the contract is assessed as a medical treatment contract, the warranty standards are not applicable from the outset; a treatment which the plaintiff claims not to have been lege artis did not result in the procedure of taking evidence. If one judges the contract as a contract for work and services, there is no defect because - as owed - corresponding top hair has formed. 
As regards the claim for non-material damages for the unauthorised publication of the photographs, the applicant submits that B***** must be regarded as an agent of the defendant; independent undertakings may also be agents. This means that the defendant must in principle be liable for the fault of B***** with regard to the contractual obligations. However, the attribution of liability under Paragraph 1313a of the ABGB does not lead to the conclusion that the defendant must be held responsible for B*****'s arbitrary and sole action with regard to the publication of the photographs. It is true that unauthorised acts could be committed intentionally by the vicarious agent in a manner attributable to the debtor, but this would require an internal 
Factual connection of the damaging act of the vicarious agent with the 
Fulfilment of contract. Only if the unlawful act of the assistant interferes with the scope of duties for the performance of which he was appointed by the debtor, or if the assistant, of his own accord, commits acts which are not owed to him, but which are not entirely unrelated to the objective connection with the pursuit of the interests sought by the debtor, the debtor shall be liable for the conduct of the assistant. The defendant party could not be held liable for the actions of B***** and its employees pursuant to § 1313a of the Austrian Civil Code (ABGB) because the posting of the photos with the name of the plaintiff online was not covered by the treatment contract and therefore was not in any internal connection with it. The employees of B***** had not been active in the area of responsibility assigned to B*****. Rather, the damaging act was only occasionally carried out in fulfilment of the defendant party's obligation to perform.
In so far as the plaintiff relied on Section 33 of the DSG 2000 and thus on a violation of his fundamental right to data protection, the DSGVO had come into force during the proceedings. Pursuant to Article 69 (4) of the DSG, proceedings pending before the ordinary courts under the DSG 2000 at the time of entry into force of this Federal Act were to be continued in accordance with the provisions of this Federal Act and the DSGVO. The successor provision to § 33 of the DSG 2000 is contained in § 29 of the DSG, which in turn refers to the claim for damages under 
Art 82 DSGVO. The defendant party was neither the person responsible for nor the processor of the photographs subsequently published, it had neither produced nor processed them. In particular, they have nothing to do with the online placing of the photographs and the corresponding text, stating the name of the plaintiff. Nor did the defendant have to expect that B***** employees would use photographs of the plaintiff, even during the operation, for advertising purposes on the Internet without his consent. Even if the plaintiff's right to the protection of his personal data had undoubtedly been violated in the same way as the protection of portraits according to § 78 UrhG, the defendant was not responsible for this.
The applicant's appeal against that judgment is based on an incorrect legal assessment. He requests the amendment in the sense of a statement of claim or, in the alternative, an application for annulment.
In its response to the appeal, the defendant requests confirmation of the contested decision. 
The appeal, which had to be dealt with in closed session in accordance with § 480 (1) ZPO, is not entitled.
I. 1 In his appeal, the plaintiff criticizes the fact that the court of first instance did not deal with the title of damages with regard to the claim for recovery. 
The contract had also included pre- and post-operative care. From the fact that after 
In the applicant's view, the fact that no further follow-up treatment was given to the defendant after the defendant's letter of formal notice from the applicant's representative indicates that, although further treatment was to be given, it was not given. 
This criticism is not true: An interpretation of the contract oriented towards an objective recipient of the explanation shows that follow-up treatment is probably only owed as long as it is necessary for the healing process and for further hair growth. Five days before the letter of formal notice dated 13 September 2017, however, it had already been established that the hair was growing again. The fact that further follow-up treatments would have been necessary nevertheless does not result from the findings made and was not claimed in this form. The instruction of the defendant party not to carry out any further after-treatments may have been primarily a reaction to the letter of formal notice, but does not justify the assumption that contractually owed after-treatments were not carried out. In the absence of an established (or ascertainable) breach of contract, no claim for damages can be derived from it. 
2) The fact that, as the plaintiff now submits for the first time in the appeal, the contract should have been fulfilled on 1 September 2017, as he should have taken up his new position as managing director on that date, is an irrelevant innovation under section 482 of the Code of Civil Procedure, which does not need to be further discussed. The omission at first instance 
The submission cannot be replaced by evidence such as the plaintiff's statement (RIS-Justice RS0037915 [T2], RS0043157). Moreover, the appellant overlooks the (actually overshooting) finding, which he left unchallenged, that it could not be established that he had been promised that the current appearance would be given after only a few weeks. 
The supplementary findings requested by him in this connection, which amount to the fact that the success agreed upon as of 1 September 2017 had not yet occurred at this point in time, do not take up any secondary deficiencies in the findings on closer examination, but in fact pursue findings to the contrary on a subject area on which the court of first instance had already made findings (albeit overshooting) anyway. Since the appellant does not explain for what considerations the assessment of evidence leading to this negative finding is to be incorrect, it is - apart from the innovation - also not legally executed as an actual statement of facts. As an actual secondary finding defect, which the appellant also assumes, it fails because of the aforementioned prohibition of innovation. The dismissal of the 
The claim for repayment of EUR 5,880.00 must therefore be confirmed even after an assessment under compensation law.
II. 1 In his further remarks, the plaintiff (exclusively) contests the assessment of the court of first instance; even under the DSGVO, his claim for payment of EUR 20,000.00 was not justified. If, as in this case, this claim is derived from several independent legal facts, then the other claims are to be disregarded, since the appellate court is bound by a limitation of the pleas in law by the appellant (RIS-Justiz RS0043352 [T23, T26, T30, T31 and T 33]). The following explanations are therefore limited solely to the question of whether the DSGVO is capable of establishing the plaintiff's claim for non-material damages. 
2 The court of first instance correctly points out that Section 69(4) of the DSG, as amended by the Data Protection Amendment Act 2018 (BGBl I 2018/120), provides that at the time of the 
If this Federal Act enters into force (on 25.5.2018; Section 70 (1) leg cit), proceedings pending before the Data Protection Authority or before the ordinary courts relating to the Data Protection Act 2000 must be continued in accordance with the provisions of this Federal Act and the DSGVO, with the proviso that the jurisdiction of the ordinary courts remains intact (6 Ob 131/18k).
The court of first instance also correctly refers to Paragraph 29(1) of the DSG as the successor provision to the former Paragraph 33 of the DSG 2000, according to which any person who has suffered material or non-material damage as a result of a breach of the DSGVO or of Paragraph 1 or Article 2 1 Principal is entitled to claim damages against the person responsible or against the processor under Article 82 of the DSGVO, with the general provisions of civil law applying to this claim for damages. In contrast to Art 33 (2) DSG 2000, Art 29 DSG no longer contains a separate provision on liability for assistants. This is based on the general provisions of civil law (Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG, § 29 Rz 3).
According to its Article 2(1), the DPA applies to the processing of personal data wholly or partly by automatic means and to the non-automatic processing of personal data which are or are to be stored in a file system. 
§ Article 4 (1) DSG orders that the DSGVO and the DSG apply to the wholly or partially automated processing of personal data and to the non-automated processing of personal data which are stored or are to be stored in a file system.
According to the legal definition of Art 4 Z 2 DSGVO, "processing" also includes 
storage, use, disclosure by transmission, dissemination or any other means 
Form of provision. According to the legal definition, whether these processes are carried out with or without the aid of automated procedures is irrelevant.
Automated processing always occurs when data processing equipment is used, regardless of whether the data is stored in a structured manner. Thus, any use of computer, Internet or e-mail leads to the applicability of the Regulation as soon as personal data are involved. The broad concept of Art 2 (1) DPA is likely to cover all computer-based processing of personal data in common use today (cf. 6 Ob 131/18k). 
3.	The plaintiff in the proceedings at first instance did not make any submissions on the material scope of the DSGVO. The judgment states that the handwritten documents, namely the medical history sheet and the pre- and post-operative instructions of B***** were sent from P***** F***** to both the defendant in Germany and B***** in Greece. It does not follow from this that computer processing of the plaintiff's name would have been carried out or that the name transmitted by analogy was or should have been stored in a file system. Therefore, the factual scope of application of the DSGVO is missing with regard to the names transmitted by the defendant party at B***** - correctly assessed as its vicarious agent. The defendant party may therefore have acted in terms of content with regard to the collection and forwarding of the name to the B***** as the person responsible and processor under contract in the sense, but not in accordance with Art 4 Z 7 and 8 DSGVO. In view of the unasserted and therefore unestablished prerequisites for the material scope of application of the DSGVO, these activities do not trigger any legal consequences under the DSGVO, in particular under Art 82 DSGVO.
4.	Apart from sending the name of the plaintiff to B*****, which is not subject to the DSGVO regime, it can be assumed that the plaintiff has given his consent, since the documents request information on the health status of the plaintiff for the purpose of safe hair transplantation and post-operative treatment, and both the medical anamnesis sheet and the pre- and post-operative instructions are all in B***** and signed by the plaintiff himself. There is therefore also no illegality with regard to the mention of the name. Since the defendant lawfully disclosed the plaintiff's name to B*****, B***** also lawfully disposed of the plaintiff's name. The unlawfulness only began when photographs of the plaintiff taken by employees of B***** were published on the Internet contrary to his instructions and, moreover, linked to his name. With regard to the taking of the photos themselves, the plaintiff has partly given his consent, but there are no corresponding findings with regard to a possible consent to the photos taken during the operation. However, this is not the decisive point, as will be explained later. 
5.	With the publication of the plaintiff's name and photos on the Internet, the material scope of application of the DSGVO is given due to the necessary computer-supported processing. According to this, B***** is to be regarded as the person responsible and processor in the sense of Art 4 Z 7 and 8 DSGVO with regard to the publication of the plaintiff's name and photo. It has already been demonstrated that the defendant is liable for B***** under the general provisions of civil law pursuant to the last sentence of Article 29.1 of the DSGVO. Against the correct assessment of the court of first instance, despite the fact that, in principle, pursuant to § 1313a 
If the defendant's liability for the activities of the B*****, which exists under Article 82 (1), (2) and (4) of the Austrian Civil Code, is excluded - in the absence of an internal connection with the treatment contract - the defendant is not liable for the actions of B***** employees discussed here, the appeal is not directed at all. However, such a claim does not exist:
6.	If only the data controller was involved in a processing operation on his own, his liability in the event of a breach of the DPA and causal damage is automatically based on Art 82(1); if the processor acts on his own, his liability is privileged under the second sentence of paragraph 2. The processor shall only be liable to the data subject if he has failed to comply with his obligations specifically imposed on him under the DSGVO or if he fails to comply with or violates the lawful instructions given to him by the person responsible (Nemitz in Ehmann/Selmayr, Datenschutz-Grundverordnung² Art 82 Rz 23).
Where several controllers or several processors or one controller and one processor are involved in the same processing operation, they shall be jointly and severally liable pursuant to Article 82(4) and Recital 146 sent. 7. However, joint and several liability presupposes that the conditions of paragraphs 2 and 3 are fulfilled. Consequently, the controller and the processor must have infringed the DPA in a processing operation, whereby the controller must be charged with any infringement pursuant to Paragraph 2 sentence 1 and the processor with an infringement specified in Paragraph 2 sentence 2. Furthermore, neither the responsible party nor the processor must be in a position to exculpate themselves according to para. 3 (Nemitz loc.cit., margin no. 25). 
The legal concept of joint liability of several actors in the context of a processing operation is not in itself new compared to the current Data Protection Directive. Its legal definition has been adopted almost unchanged in Art 4 (7) of the DPA; the DPA 2000 also already recognised jointly responsible parties. According to the DSGVO, every person responsible is liable regardless of whether he or she has himself or herself engaged in conduct that is adequately causal, illegal or culpable and has caused the damage to the person concerned. The aggrieved party must only prove that he or she has suffered adequate causal damage as a result of processing in breach of the Regulation and how high this material or non-material damage is to be assessed. In order to strengthen the rights of data subjects, Art 82 (4) DSGVO provides for joint and several liability of all liable actors in the event of processing by several actors (Horn in Knyrim, Datenschutzgrundverordnung [The New Data Protection Law in Austria and the EU], 163f).
Even if claims for damages can be asserted against all persons responsible or contract processors of a processing operation, a claim against the Defendant based on the DSGVO fails here because, in the absence of successful proof of the material scope of application of the DSGVO, the Defendant cannot be qualified as either a person responsible or a contract processor with regard to the mention of the plaintiff's name. The defendant had no part in the subsequent taking of the photos, the linking of the plaintiff's name to these photos and their publication on the Internet. In this respect, it is itself neither responsible nor a processor. A liability of the defendant according to DSGVO does not arise from this. 
7.	Even if the absence of the material scope of application of the DSGVO with regard to the mention of the name at B***** were to be disregarded and the defendant were to be judged with regard to this data treatment both as the person responsible and as the principal under Art. 4(7) and (8) DSGVO, it would in any event benefit from the exemption from liability under Art. 8(3) DSGVO: under this provision, the person responsible or the processor is exempted from liability under Paragraph 2 if he proves that he is in no way responsible in any way for the circumstance as a result of which the damage occurred. 
In German literature (Nemitz in Ehmann/Selmayr, Datenschutzgrundverordnung² Art 82 
para. 19), it is argued that the exemption from liability thus only applies if the person responsible or the processor commissioned can prove a fault rate of 0% or either there must not be a causal connection between the violation of the DSGVO and the damage or the violation is only based on an unavoidable event. This prerequisite already exists in so far as the mere fact that the 
With the consent of the plaintiff, the name of the plaintiff was mentioned at B***** no fault of the defendant can be established.
According to Austrian doctrine (Horn in Knyrim, Datenschutzgrundverordnung, 164), the exemption from liability refers to lack of causality or lack of fault; it should also be possible to prove the lack of illegality. The established conduct of the employees of B***** is above all similar to the case described in a further literary opinion (Schweiger in Der DatKomm, Art 82 Rz 91): According to this, the aggrieved party against whom claims are asserted has the opportunity to prove that an unforeseeable intervention of a third party in the processing process, such as a deliberate breach of an obligation under the employment contract by an otherwise reliable person employed by the employee responsible, was committed. 
The unauthorised action of employees of the Greek B***** to put the name of the applicant on photographs not released by the applicant and to publish them on the internet constitutes an interference, unforeseeable for the defendant, in the initially lawful disclosure of the applicant's name to B*****, with the result that the defendant can no longer be held responsible for that circumstance. The dismissal of the claim therefore proves to be justified, the appeal must remain unsuccessful.
III. 1 The decision on costs is based on Articles 50 and 41 of the Code of Civil Procedure. 
2) The ordinary appeal pursuant to § 502 (1) ZPO was to be admitted, since no supreme court jurisdiction could be found on the question of liability pursuant to § 82 DSGVO in the case of only partially existing material scope of application and on the question of exemption from liability pursuant to Art 82 (3) DSGVO.
 
Linz Higher Regional Court, Department 6
Linz, June 12, 2019
Bernhard Telfser, Judge
 
Electronic copy according to § 79 GOG