VK Baden-Württemberg - 1 VK 23/22: Difference between revisions

Revision as of 14:33, 3 August 2022

VK BaWü - Az. 1 VK 23/22

Court:	VK BaWü (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 44 GDPR §57(1)(4) VgV
Decided:	13.07.2022
Published:
Parties:
National Case Number/Name:	Az. 1 VK 23/22
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Rewis (in German)
Initial Contributor:	n/a

The Procurement Chamber Baden-Württemberg held that a transfer within the meaning of Article 44 GDPR constitutes any disclosure to a recipient in a third country or an international organization, irrespective of the nature of the disclosure or the disclosure to a third party, regardless of whether the data is actually accessed.

English Summary

Facts

The case concerns a decision by the Vergabekammer Baden-Württemberg ("Procurement chamber Baden-Wuerttemberg"), the administrative authority that reviews the public procurement procedures.

On 3.11.2021, a public authority issued a Europe-wide invitation to tender for the procurement of software for digital management via an open procedure. The award criteria contained, among other things, requirements for data protection and IT security. The public authority received offers from company A and company B.

Company A is a subsidiary of an undertaking located in the US, with servers that are located in the EU. Furthermore, company A included clauses in the offer that stated, among other things, that it will not access, use, or disclose customer data to any third party, except as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body.

On 04.05.2022, the public authority informed the companies that that the contract would be awarded to company A, as their evaluation of the price was the most economical. Company B then challenged this decision by the authority, arguing that company A had made illegal changes to the tender documents and should have therefore been excluded from the procedure.

Holding

The Procurement Chamber agreed with company B that company A made illegal changes to the tender documents pursuant to §57(1)(4) VgV. This provision excludes bids where "amendments or additions" have been made to the tender documents. The Chamber noted that this does not require formal changes to the wording, but is already present when the company deviates from the documents' specifications, resulting in an offer for a different service than the one tendered out.

In this regard, the Chamber pointed out that compatibility with relevant data protection law was a specification of the documents in the invitation to tender. It followed that company A's service qualified as an unlawful transfer of data to a third country because their parent company was located in the US, violating relevant data protection law (Article 44 GDPR).

The Chamber explained that a transfer in this context must also be assumed when data can be accessed from a third country, regardless of whether this actually takes place. The fact that the physical location of the server that provides such access was located in the EU was irrelevant.

Therefore, the Chamber held that company A changed the documents within the meaning of §57(1)(4) VgV by violating Article 44 GDPR, and concquently had to be excluded from the procedure.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Since a bidder naturally has only limited insight into the course of the award procedure, he may claim in the award review procedure what he can honestly consider to be likely or possible on the basis of his - often only limited - level of information, for example when it comes to award violations that exclusively_ play in the sphere of the awarding authority or concern the offer of a competitor (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para. 28; OLG Düsseldorf, decision of April 13, 2011, VII-Verg 58/10 , juris, para. 53; OLG Frankfurt, decision of July 9th, 2010, 11 Verg 5/10, juris, para. 51; OLG Dresden, decision of June 6, 2002, WVerg 4/02, juris, para. 18 f. ). However, if the violation of public procurement law is not completely beyond his ability to inspect, the applicant must at least present actual connecting facts or indications that justify a reasonable suspicion of a specific violation of public procurement law (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para 28; Düsseldorf Higher Regional Court, decision of August 16, 2019, VII-Verg 56/18, juris; Munich Higher Regional Court, decision of June 11, 2007, Verg 6/07, juris, para. 31). A minimum of substantiation must be observed; Pure assumptions about possible award violations are not sufficient (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para. 28; OLG Brandenburg, decision of May 29, 2012, Verg W 5/12, juris, para. 4; Munich Higher Regional Court, decision of August 2, 2007, Verg 7/07, juris, para. 15 f.).

@@ Line 78: / Line 78: @@
 The Procurement Chamber agreed with company B that company A made illegal changes to the tender documents pursuant to §57(1)(4) VgV. This provision excludes bids where "amendments or additions" have been made to the tender documents. The Chamber noted that this does not require formal changes to the wording, but is already present when the company deviates from the documents' specifications, resulting in an offer for a different service than the one tendered out.
-In this regard, the Chamber pointed out that compatibility with relevant data protection law was a specification of the documents in the invitation to tender. It followed that company A's offer violated relevant data protection law, more specifically [[Article 44 GDPR]].
+In this regard, the Chamber pointed out that compatibility with relevant data protection law was a specification of the documents in the invitation to tender. It followed that company A's service qualified as an unlawful transfer of data to a third country because their parent company was located in the US, violating relevant data protection law ([[Article 44 GDPR]]).
-The Chamber specified that the GDPR does not provide a definition of a 'transfer' within the meaning of [[Article 44 GDPR]]. Even though [[Article 4(2) GDPR]] refers to the "disclosure by transmission" as a form of processing, the GDPR does not consider "disclosure by transmission" equivalent to "transfer" in [[Article 44 GDPR]].
+The Chamber explained that a transfer in this context must also be assumed when data ''can'' be accessed from a third country, regardless of whether this actually takes place. The fact that the physical location of the server that provides such access was located in the EU was irrelevant.
-The Chamber found that a transfer must be interpreted as: any disclosure of personal data to a recipient in a third country or an international organization, irrespective of the nature of the disclosure, or the disclosure to a third party. A disclosure in this context must also be assumed when personal data is posted on a platform that ''can'' be accessed from a third country, regardless of whether this actually takes place. It followed that the physical location of the server that provides such access was irrelevant. As defendant II's parent company is based in the US, leads to an impermissible transfer of data to a third country, regardless of the fact that they (and their servers) are situated in the EU.
+Therefore, the Chamber held that company A changed the documents within the meaning of §57(1)(4) VgV by violating Article 44 GDPR, and concquently had to be excluded from the procedure.
-Therefore, the Chamber held that company A changed the documents within the meaning of §57(1)(4) VgV and concquently had to be excluded from the procedure.
 == Comment ==