BGH - VI ZR 109/23: Difference between revisions
(Created page with "{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BGH |Court_Original_Name=Bundesgerichtshof |Court_English_Name=German Supreme Court |Court_With_Country=BGH (Germany) |Case_Number_Name=VI ZR 109/23 |ECLI= |Original_Source_Name_1=REWIS |Original_Source_Link_1=https://rewis.io/urteile/urteil/rjl-28-01-2025-vi-zr-10923/?hl=DSGVO |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_Source...") |
No edit summary |
||
| Line 74: | Line 74: | ||
}} | }} | ||
The BGH held, that the unsolicited sending of an advertising email following a transaction in an online shop does not in itself constitute a loss of control. The | The BGH held, that the unsolicited sending of an advertising email following a transaction in an online shop does not in itself constitute a loss of control. The failure of the controller to respond to messages from the data subject cannot justify a claim for damages, but at most intensify it. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
The | The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject claimed that the processing was unlawful and requested its cessation under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The controller argued that its processing was justified under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. | ||
=== Holding === | === Holding === | ||
The BGH held that the | The BGH held that the controller failed to demonstrate a legitimate interest under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The Court emphasized that the balancing test requires a detailed assessment, considering the nature of the data, the reasonable expectations of the data subject, and potential risks. | ||
The ruling highlighted the necessity principle under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]], stating that the data processing must be strictly required for the stated purpose. | |||
The BGH also referenced the data subject’s right to erasure under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]], confirming that companies cannot rely on vague business interests to override fundamental rights. | |||
Consequently, the Court ruled in favor of the data subject, ordering the cessation of unlawful data processing and potential damages for GDPR violations. | |||
== Comment == | == Comment == | ||
Revision as of 15:16, 27 March 2025
| BGH - VI ZR 109/23 | |
|---|---|
 | |
| Court: | BGH (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 17(1)(d) GDPR Charter of Fundamental Rights of the European Union (CFR) Directive 2002/58/EC (ePrivacy directive) German Federal Data Protection Act (BDSG) |
| Decided: | 28.01.2025 |
| Published: | |
| Parties: | a private individual (plaintiff) a commercial entity (defendant) |
| National Case Number/Name: | VI ZR 109/23 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | REWIS (in German) |
| Initial Contributor: | Lejla Rizvanovik |
The BGH held, that the unsolicited sending of an advertising email following a transaction in an online shop does not in itself constitute a loss of control. The failure of the controller to respond to messages from the data subject cannot justify a claim for damages, but at most intensify it.
English Summary
Facts
The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards.
Holding
The BGH held that the controller failed to demonstrate a legitimate interest under Article 6(1)(f) GDPR. The Court emphasized that the balancing test requires a detailed assessment, considering the nature of the data, the reasonable expectations of the data subject, and potential risks.
The ruling highlighted the necessity principle under Article 5(1)(c) GDPR, stating that the data processing must be strictly required for the stated purpose.
The BGH also referenced the data subject’s right to erasure under Article 17(1)(d) GDPR, confirming that companies cannot rely on vague business interests to override fundamental rights.
Consequently, the Court ruled in favor of the data subject, ordering the cessation of unlawful data processing and potential damages for GDPR violations.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
VI ZR 109/23 January 28, 2025 Federal Court of Justice, 6th Civil Senate Judgment Area: Civil Law Previous: Regional Court of Rottweil, March 15, 2023, Ref. No. 1 S 86/22 Article 82(1) EUV 2016/679 Suggested citation: Federal Court of Justice, Judgment of January 28, 2025, Ref. No. VI ZR 109/23 (REWIS RS 2025, 992) Paper references: REWIS RS 2025, 992 Open on mobile device. The decisions presented here may not be final or may have already been overturned by higher courts.
