LG Köln - 28 O 221/21

LG Köln - 28 O 221/21
Court:	LG Köln (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(f) GDPR Article 17(1)(a) GDPR Article 17(1)(d) GDPR
Decided:
Published:	16.02.2022
Parties:	SCHUFA Holding AG
National Case Number/Name:	28 O 221/21
European Case Law Identifier:	ECLI:DE:LGK:2022:0216.28O221.21.00
Appeal from:
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Justiz NRW (in German)
Initial Contributor:	lacrosse

The Regional Court Cologne held that the SCHUFA is allowed to process information about the discharge of residual debt by an insolvency court for 3 years.

English Summary

Facts

The controller is the biggest German credit rating agency “SCHUFA Holding AG”. The data subject is a consumer with a low credit score. In October 2020, an insolvency court discharged the data subject of a residual debt he had with a third party for the amount €45,000. The controller added the information about the discharge to its database. The entry contained the information that a discharge of residual debt had been granted, the date of the decision and its case number.

In February 2021, the data subject objected to the processing and requested the controller to erase the entry altogether. The controller rejected the request by referring to the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), under which the information will be deleted only after three years have passed. The Rules of Conduct are a code of conduct within the meaning of Article 40(5) GDPR which was approved by the Hesse DPA (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).

Consequently, the data subject filed a lawsuit against the controller before the Regional Court Cologne (Landgericht Köln - LG Köln) requesting that the court orders the controller to delete the entry. He argued that the entry makes it impossible for him to find a new and bigger apartment to start a family with his partner, to obtain a property loan for a new apartment, to open up a new bank account, to conclude a new mobile phone or power supply contract or to get a new job as a salesman.

From the time the controller included the information in its database until the end of the court proceedings, no customer of the controller requested information about the data subject.

Holding

The Regional Court of Cologne (Landgericht Köln - LG Köln) rejected the data subject's lawsuit. It found that the the data subject had no right to erasure under Article 17(1)(a), (c) or (d) GDPR, because the controller was processing the data lawfully under Article 6(1)(f) GDPR and the processing was still necessary in relation to the controller's purposes of providing relevant credit rating information to to its customers.

First, the court reasoned that the services of a credit rating agency are carried out in the public interest, but Article 6(1)(e) GDPR could not constitute a legal basis for the processing because there was no specific legal basis in Union or Member State Law as required by Article 6(3)(b) GDPR.

Second, the court found that the interests pursed by the controller and its customers overrode the interests of the data subject under Article 6(1)(f) GDPR. The court determined that the purpose of the controller's activity is to provide the customers of the controller with relevant credit rating information and to help lenders fulfill their legal obligation to check the financial capacity of their contract partners, thereby safeguarding the stability of economic transactions in Germany. The court held that these interests - although partly of abstract nature - can be considered in the balancing act under Article 6(1)(f) GDPR and rejected the opinion of the Higher Regional Court Schleswig (OLG Schleswig - 17 U 15/21) that the interests of the controller's customers can only be considered under Article 6(1)(f) GDPR if a request to information was made to the controller. The court further held that the "Rules of Conduct" itself do not constitute a valid legal basis for the processing and do not substitute the balancing of interests by the courts under Article 6(1)(f) GDPR, but can generally be considered a fair result if there are no specific atypical circumstances to the contrary. Moreover, the court rejected the view of the OLG Schleswig (17 U 15/21) that information about insolvency proceedings must be deleted by a credit rating agency after 6 months according to the objective pursued by § 3(1) InsoBekV. The court found that § 3(1) InsoBekV is not directly applicable, because it only refers to the official publication of information about an insolvency proceedings under www.insolvenzbekanntmachungen.de and not the processing of the data by a credit rating agency. It also found that § 3(1) InsoBekV cannot be applied analogously, because the two requirements of an analogous application were not met. The first requirement is an unintended gap in the law which the court found was not there, because the legislator once intended to prescribe shorter retention periods for credit rating agencies but in the end did not pass such a provision because of concerns about its conformity with EU law. The court also reasoned that the second requirement was not met, which is that the situation in question is in every crucial characteristic comparable to the situation regulated by the provision. It found that the situation regulated by § 3(1) InsoBekV is crucially different because it refers to a public accessible database and not a credit rating agency. Moreover, the court found that it is legally not persuasive to refer to a national provision in order to interpret and apply a EU provision, such as Article 6(1)(f) GDPR, without their being an escape clause like Article 23 GDPR.

Third, the court held that the data subject did not validly object to the processing of the data under Article 21(1) GDPR, because he did not bring forward any "grounds relating to his [...] particular situation". It found that this requires the data subject to provide facts which form an atypical situation and give the interests of the data subject a special significance. The court reasoned that the consequences of the entry brought forward by the data subject did not establish such an atypical situation. Regarding a new apartment and a new job, the court found that the data subject did not sufficiently show that he was in fact looking for a new apartment or a new job. Regarding a new bank account, the court considered it sufficient that the data subject already had one. Regarding a new mobile phone and power supply contract, the court reasoned that this is not an atypical but a typical consequence of a discharge of residual debt. Finally, the court held that, even if there were "grounds relating to [the data subject's] particular situation", the interests of the controller and its customer would have overridden the data subject's interests.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

The defendant is a joint institution of the lending German economy. The defendant's task is to provide its contractual partners with information that is suitable for protecting them from losses in credit-related transactions. At the same time, the information opens up the possibility for the defendant's contractual partners to protect those interested in credit-related transactions from excessive debt by providing advice. For this purpose, the defendant's contractual partners transmit relevant data from the business relationships with their customers. The defendant stores the data transmitted to it in order to provide its contractual partners with information if they assert a legitimate interest in receiving it. Before concluding a credit-relevant transaction, the defendant's contractual partners can use the information and other information available to the contractual partner to check what risks the prospective transaction entails.
3

The plaintiff is 31 years old and has lived with his wife in a small apartment in L since May 2020. He has had a current account with T since December 2020 and works as a permanent seller.
4

On October 6th, 2020 he was granted an exemption from residual debt. The defendant then copied the following entry about the plaintiff into its file:
5

"Residual debt exemption granted This information comes from the publications of the insolvency courts. We were informed of the granting of the residual debt exemption for these insolvency proceedings. File number: 00000 The process is managed by the insolvency courts under this file number. Date of the event: 06.10.2020"
6

The post will be deleted after three years, i.e. on October 6th, 2023. In the defendant's database, claims in the amount of more than EUR 45,000.00 were previously documented, which were marked as settled with the granting of the discharge from residual debt and are no longer displayed. From the time the residual debt was released until the lawsuit was filed, the defendant had not received any inquiries from potential landlords, mobile phone companies or energy suppliers about the plaintiff's data.
7

In a letter from a lawyer dated February 9th, 2021, the plaintiff, setting a deadline of February 23rd, 2021, lodged an objection with the defendant against the processing of his personal data and requested the defendant to delete it. In a letter dated March 5th, 2021, the defendant rejected the deletion.
8th

The plaintiff claims that he is seriously looking for a flat with his partner because the previous flat is too small for starting a family. He could afford a larger apartment with his income. The entry prevents the renting of a larger apartment. A real estate loan was therefore not granted to him. He could also not open a new current account because of the entry. The opening of an account with E and D failed because of the entry. He would also not find a new job as a salesman because of the entry. He also couldn't sign a new mobile phone or energy supplier contract, even if he could save costs if he wanted to. This whole situation is detrimental to his health.
9

The plaintiff is of the opinion that the district court has subject matter jurisdiction. Since his economic existence is threatened, the amount in dispute is to be set at at least 10,000 euros for application 1), for application 2) at 5,000 euros. The plaintiff claims that he has a right to erasure based on Article 17(1)(a) GDPR against the defendant. Since the discharge of the residual debt had been granted, the defendant was no longer interested in the storage of his data. After all, the plaintiff no longer owed anything. The defendant cannot hold up its own economic interests to the plaintiff. In turn, an economic restart is made impossible for him. However, this is the objective of the insolvency code, the rules of which are conclusive in this respect. A regulation for data processing is not included there. The defendant is trying to circumvent these standards and to sanction the plaintiff for the discharge of the residual debt. The T entry is also not to be compared with the insolvency notice. The defendant also violated its obligations under Art. 5 DS-GVO. There is also a claim based on Art. 17 (1) c), since the plaintiff has lodged an objection to the processing of the data. His interests justify a special personal situation according to Art. 21 Para. 1 DS-GVO.
10

The plaintiff requests
11

1. to order the defendant to disclose the information stored in its electronic database (computer): "Residual debt exemption granted This information comes from the publications of the insolvency courts. We were informed of the granting of the residual debt exemption for these insolvency proceedings. File number: 00000 The process is managed by the insolvency courts under this file number. Date of the event: 06.10.2020" to be deleted.
12

2. to order the defendant to restore the plaintiff's score value in such a way as if the storage made under application 1) had not existed.
13

The defendant requests
14

              reject the complaint.
15

The defendant is of the opinion that the discharge of the residual debt does not serve to enable the plaintiff to take on new debts, but should prompt potential lenders to specifically check the plaintiff's creditworthiness. It must be taken into account that there was massive debt before the residual debt was discharged, which still needs to be explained to a lender. Therefore, the entry is still necessary within the meaning of Article 17 (1) (a) GDPR. The storage period of three years is also appropriate and transparent within the meaning of Article 5(1)(e) GDPR. The Code of Conduct, to which the defendant is obliged and which regulates this duration, was agreed with the data protection supervisory authority responsible for the defendant, the G. There is also no special situation within the meaning of Art. 17 Para. 1 lit. c), 21 Para. 1 S. 1 DS-GVO. The plaintiff was able to find a new apartment during the good conduct phase, although the ongoing insolvency proceedings were still registered with the defendant at that time. On December 30, 2020, i.e. despite the existence of the disputed entry, T reported the opening of a new current account for the plaintiff. Even if the conditions alleged by the plaintiff were correct, the difficulties described would correspond to the "normal course of events" after insolvency proceedings. Alternatively, the general interests would outweigh the interests of the plaintiff despite the special situation. A claim for recalculation of the score value is also not apparent. It would also be superfluous, since the defendant automatically recalculates the score after each deletion of an entry.
16

Reasons for decision:
17

The admissible action is unfounded.
18

I
19

The lawsuit is admissible. The district court of Cologne is responsible for this. Irrespective of the specific amount in dispute, the jurisdiction of the regional court results from § 39 ZPO, because the representative of the defendant negotiated the main issue orally without asserting the lack of jurisdiction.
20

II.
21

The lawsuit is unfounded.
22

1.
23

The plaintiff has no claim against the defendant for the deletion of the entry of his discharge of residual debt from Article 17 (1) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th, 2016 for the protection of natural persons with the processing of personal data, free of charge data traffic and to repeal Directive 95/46/EC (General Data Protection Regulation, GDPR).
24

a) A claim does not arise from Article 17 (1) (a) or (d) GDPR, because neither the storage of the data nor the further processing by the defendant was unlawful from the start, nor is the further processing of the data are no longer necessary for the purposes for which they were collected.
25

The collection, storage and (potential) disclosure of information about the plaintiff is processing of personal data by the defendant in accordance with Art. 4 GDPR. This is the “responsible person” within the meaning of Art. 4 No. 7 GDPR. It is undisputed that the plaintiff did not give his consent (Art. 6 Para. 1 lit. a) GDPR). Whether the defendant performs a task in the public interest or in the exercise of public authority (cf. Art. 6 Para. 1 lit. e) GDPR) is irrelevant. In case law, a public interest in the credit reporting procedure of the defendant has long been recognized (Federal Court of Justice, judgment of July 7th, 1983 - III ZR 159/82; Wiesbaden Regional Court, judgment of September 14th, 2016 - 8 S 29/15; Würzburg Regional Court, judgment of 21.03.2016 - 71 O 1216/15). In any case, there is no separate legal basis required for data processing in accordance with Article 6(1)(e) GDPR in accordance with Article 6(3)(1)(b) GDPR (OLG Schleswig, judgment of July 2nd, 2021 - 17 U 15/21, NZI 2021, 794; Cologne Higher Regional Court, judgment of January 27, 2022 - 15 U 153/21, BeckRS 2022, 1208, para. 17).
26

However, the data processing by the defendant is lawful because it is permissible under Article 6(1)(f) GDPR. There is a "legitimate interest" of the defendant's contractual partners in the data processing, which outweighs the interests and fundamental rights of the plaintiff.
27

The defendant gives its contractual partners information if they want to conclude credit-related transactions with a person. This information is required to compensate for the information disparity between lenders and borrowers (OLG Köln, loc.cit., para. 18 ff.). Otherwise, the lenders would only have to rely on the self-declaration of potential borrowers. The processing of the data by the defendant essentially serves to enable lenders to make an accurate and objective assessment of the creditworthiness of a potential contractual partner and thus to secure legal and credit transactions in Germany as a whole, especially since lenders are obliged under the relevant statutory provisions to to form a viable picture of the resilience of their respective contractual partners (especially in the consumer area). Contrary to a reading that is represented by the OLG Schleswig (OLG Schleswig, loc. cit., NZI 2021, 794), it is not important whether it is already certain (namely) whether and, if so, who enters into which specific contractual or pre-contractual relationships with the person concerned wool. Because even a rather abstract interest in information and the general need in credit transactions for the possibility of obtaining information form a typical, sufficiently identifiable interest that regularly occurs in the case of the granting of a loan (OLG Köln, loc.cit., para. 23).
28

The fact that the assumption of a “legitimate interest” in the data processing would conflict if the information stored by the defendant was not meaningful for creditworthiness and reliability and the information was therefore “worthless” for the defendant’s customers is not specifically the case on the plaintiff’s side did. Especially when it is - as here - (also) about a discharge of residual debt, this is a relevant date for any meaningful credit rating, because the debtor was demonstrably without assets at least at the time of the insolvency, which is also relevant for the rating of his creditworthiness today market can certainly still be of interest. The discharge of residual debt also proves that the debtor was not able to settle due claims within a period of at least six years, although he was obliged to do everything possible to pay off his debts in the good conduct phase according to §§ 287b, 295 InsO; According to the market assessment, this also has a certain relevance for the assessment of his current creditworthiness, which is nothing more than a pure forecast decision by the lender. It is therefore difficult to understand why the plaintiff was unable to settle his old debts over a period of six years, but wants to be able to meet new liabilities by being granted the discharge of residual debt. The plaintiff is not stigmatized by the disputed information about his discharge of residual debt. Rather, it is the right and duty of potential lenders to objectively assess the plaintiff's selection risk. The plaintiff demands equality with persons who have never been affected by insolvency. However, he does not have this right. If the defendant were obliged to delete the disputed entry, it would inform its contractual partners that it had no recent knowledge of the plaintiff's unreliability in the settlement of claims, which would be wrong.
29

However, unlike the old version of the BDSG, the GDPR itself does not contain any specific regulations or maximum limits for the duration of the storage of personal data, but rather links the legality of further processing solely to the criterion of necessity and thus to a consideration in the individual case. In this respect, Recital No. 39 of the GDPR stipulates that the storage period for personal data should be limited to the absolutely necessary minimum and that the person responsible - which is only appropriate in bulk transactions such as that of the defendant - should provide deadlines for their deletion or regular review. Art. 40 GDPR offers industry associations the opportunity to specify fields of application with the responsible data protection supervisory authorities through rules of conduct that are binding at least for them and the supervisory authorities. That happened in the present case: The Association of Credit Agencies e.V., to which the defendant belongs, has "rules of conduct for the checking and deletion periods of personal data by the German credit agencies from May 25th, 2018" (so-called "code of conduct") in the sense of a self-commitment of the members, which have been approved by the competent data protection authority of the state of Hesse in accordance with Art. 40 (5), 55 (1) GDPR in conjunction with Section 40 BDSG. In these rules of conduct, specific checking and deletion periods are listed for the individual personal data of the debtor. The challenged processing of the data for the discharge of residual debt is covered by the deadline regulation (cf. Section II No. 2 b) of the "code of conduct"). On the basis of these regulations, the storage and further processing of the plaintiff's data would (currently) be free of objections, since the relevant 3-year period has not yet expired.
30

The regulations in the "code of conduct" themselves do not offer any material legal basis; they also do not prescribe the weighing in the context of Art. 6 (1) lit. f GDPR and ultimately do not replace the weighing of interests by the courts. However, the code of conduct is to be used and recognized as at least in the normal case a considerable and appropriate balance of interests between the parties involved for data protection-compliant storage of information if - as here - no concrete indications for a different assessment are presented and/or otherwise apparent (OLG Köln, loc.cit., para. 26).
31

Contrary to the position of the Schleswig Higher Regional Court (loc Insolvency announcements on the Internet are to be deleted after six months (OLG Cologne, loc.cit., para. 27). The legal regulation is not directly applicable to entries in the defendant's database, because the storage period stipulated in the regulation only applies to public announcements in the insolvency proceedings. An analogous application is already ruled out in view of the missing (unplanned) regulatory gap. In the last legislative period, an early draft of Section 301 (5) InsO-RefE provided for an express legal regulation with regard to short storage periods for credit bureaus. On the other hand, after concerns about European law had been raised (Thüsing/Flink/Rombey, NZI 2020, 611 ff.), such a regulation was deliberately avoided (BT-Drs. 19/25322, 5, 7) and only an evaluation clause was included in Art. 107a para. 1 sentence 2 EGInsO included in the law.
32

Also from a regulatory point of view, it is not convincing to resort to regulations in national law for the interpretation of the European law regulation in Art. 6 Para. 1 lit Utilization of the statutory opening clauses (also) to Art. 17 GDPR, for example in Art. 23 lit. i and j GDPR (on all this with further reference to Cologne Higher Regional Court, loc. cit., para. 27 et seq.).
33

Even an only indirect consideration of the regulatory content of § 3 InsoBekV within the consideration of Art. 6 Para. 1 lit. f GDPR is ruled out. There is a lack of comparability between the legally regulated situation and the situation at hand here: the circumstances are not comparable in terms of the personal scope and the scope of the respective data processing. On the Internet platform www.insolvenzanzeigeen.de, the entries contained there - which ultimately also deal with government interventions - can be accessed by anyone free of charge and without registration or without demonstrating a legitimate interest. Against the background of this easy retrieval, a maximum storage period of only six months makes sense. A comparable situation does not exist with the storage and processing of data by the defendant. This only provides information to its contractual partners and only to them if there is a “legitimate interest”, i.e. only if they have to check the creditworthiness of the borrower in order to conclude a loan transaction (OLG Cologne, loc. cit.).
34

The plaintiff cannot otherwise raise any overriding personal interests that speak against the appropriateness of the result of the weighing up abstractly prescribed in the "code of conduct" in the specific individual case. In particular, he cannot claim different treatment than a "classic" debtor simply because of the discharge of residual debt.
35

b) Finally, a right to erasure does not result from Article 17(1)(c) Var. 1 i. V. m. Art. 21 Para. 1 DS-GVO. According to this, there is a right to erasure if the data subject objects to the processing pursuant to Art. 21 (1) and there are no overriding legitimate reasons for the processing. The plaintiff undisputedly filed an objection to the processing of personal data concerning him on February 9th, 2021 in accordance with Article 21 (1) DS-GVO. However, he had no right to object. Such is the case if the data subject presents reasons that speak against the processing of the data due to their particular situation, and the person responsible cannot prove any legitimate reasons that outweigh the interests, rights and freedoms of the data subject. These must be reasons that justify an atypical constellation that gives the interests of the person concerned particular weight (cf. Kühling/Herbst, DS-GVO/BDSG, 2nd ed., 2018: Art. 21, para. 15). The plaintiff bears the burden of presentation and proof for the existence of the reasons. Such reasons may not have been adequately presented by the plaintiff.
36

The plaintiff states that he wants to move but cannot find a new apartment because of the entry. However, he does not substantiate the efforts he has made so far and how many rejections he has received as a result of the entry. Rather, the defendant's submission that no landlord has made a specific inquiry about the plaintiff since the registration of the discharge of residual debt has remained unchallenged.
37

He further states that the entry stands in his way when opening a new account. So he could not open accounts with E and D. This objection should not be accepted either. The plaintiff currently has a checking account with T. It is not stated or otherwise apparent that he needs another account. Incidentally, he was able to open this account despite his entries with the defendant. In addition, it is not specifically stated when he actually wants to have applied for the accounts with E and D and when he was specifically refused to open them because of the entry.
38

Insofar as the plaintiff argues that he could not find a new job as a salesman because of the registration, it is not apparent why information from the defendant could be required for an application as a salesman. According to his own statements, the plaintiff is also in a permanent position. He did not state that he was even looking for a job.
39

Insofar as the plaintiff argues that he cannot take out a real estate loan or conclude a new mobile phone or energy supply contract, this does not lead to any different conclusion either. On the one hand, the defendant's submission that no customer inquiries in this regard had been made to the plaintiff remained undisputed. On the other hand, this should not be an atypical, but rather a typical consequence of the discharge of residual debt.
40

However, even assuming a special personal situation of the plaintiff after the granting of the discharge from the residual debt, a claim for deletion could not be affirmed, since the interests of the defendant and its contractual partners in data processing outweigh the stated interests of the plaintiff. Because the credit industry has the obligation to carefully and objectively check the creditworthiness of potential borrowers before granting a loan. The defendant supports the credit companies with their information systems. If she deleted the entry, the plaintiff would be like someone who has never had a residual debt discharge. This does not adequately reflect the plaintiff's credit risk. Something else could only arise if the plaintiff could present and prove circumstances which show that insolvency proceedings were only opened due to a special personal situation which, for certain reasons, cannot be repeated in the future ( such as an illness). However, this is not the case here.
41

2.
42

Based on the above statements, the plaintiff is also not entitled to have the score restored.
43

3.