VK Baden-Württemberg - 1 VK 23/22
| VK BaWü - Az. 1 VK 23/22 | |
|---|---|
 | |
| Court: | VK BaWü (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 44 GDPR §57(1)(4) VgV |
| Decided: | 13.07.2022 |
| Published: | |
| Parties: | |
| National Case Number/Name: | Az. 1 VK 23/22 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Rewis (in German) |
| Initial Contributor: | n/a |
The Procurement Chamber Baden-Württemberg held that a transfer within the meaning of Article 44 GDPR constitutes any disclosure to a recipient in a third country or an international organization, irrespective of the nature of the disclosure or the disclosure to a third party, regardless of whether the data is actually accessed.
English Summary
Facts
The case concerns a decision by the Vergabekammer Baden-Württemberg ("Procurement chamber Baden-Wuerttemberg"), the administrative authority that reviews the public procurement procedures.
On 3.11.2021, a public authority issued a Europe-wide invitation to tender for the procurement of software for digital management via an open procedure. The award criteria contained, among other things, requirements for data protection and IT security. The public authority received offers from company A and company B.
Company A is a subsidiary of an undertaking located in the US, with servers that are located in the EU. Furthermore, company A included clauses in the offer that stated, among other things, that it will not access, use, or disclose customer data to any third party, except as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body.
On 04.05.2022, the public authority informed the companies that that the contract would be awarded to company A, as their evaluation of the price was the most economical. Company B then challenged this decision by the authority, arguing that company A had made illegal changes to the tender documents and should have therefore been excluded from the procedure.
Holding
The Procurement Chamber agreed with company B that company A made illegal changes to the tender documents pursuant to §57(1)(4) VgV. This provision excludes bids where "amendments or additions" have been made to the tender documents. The Chamber noted that this does not require formal changes to the wording, but is already present when the company deviates from the documents' specifications, resulting in an offer for a different service than the one tendered out.
In this regard, the Chamber pointed out that compatibility with relevant data protection law was a specification of the documents in the invitation to tender. It followed that company A's offer violated relevant data protection law, more specifically Article 44 GDPR.
The Chamber specified that the GDPR does not provide a definition of a 'transfer' within the meaning of Article 44 GDPR. Even though Article 4(2) GDPR refers to the "disclosure by transmission" as a form of processing, the GDPR does not consider "disclosure by transmission" equivalent to "transfer" in Article 44 GDPR.
The Chamber found that a transfer must be interpreted as: any disclosure of personal data to a recipient in a third country or an international organization, irrespective of the nature of the disclosure, or the disclosure to a third party. A disclosure in this context must also be assumed when personal data is posted on a platform that can be accessed from a third country, regardless of whether this actually takes place. It followed that the physical location of the server that provides such access was irrelevant. As defendant II's parent company is based in the US, leads to an impermissible transfer of data to a third country, regardless of the fact that they (and their servers) are situated in the EU.
Therefore, the Chamber held that company A changed the documents within the meaning of §57(1)(4) VgV and concquently had to be excluded from the procedure.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Since a bidder naturally has only limited insight into the course of the award procedure, he may claim in the award review procedure what he can honestly consider to be likely or possible on the basis of his - often only limited - level of information, for example when it comes to award violations that exclusively_ play in the sphere of the awarding authority or concern the offer of a competitor (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para. 28; OLG Düsseldorf, decision of April 13, 2011, VII-Verg 58/10 , juris, para. 53; OLG Frankfurt, decision of July 9th, 2010, 11 Verg 5/10, juris, para. 51; OLG Dresden, decision of June 6, 2002, WVerg 4/02, juris, para. 18 f. ). However, if the violation of public procurement law is not completely beyond his ability to inspect, the applicant must at least present actual connecting facts or indications that justify a reasonable suspicion of a specific violation of public procurement law (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para 28; Düsseldorf Higher Regional Court, decision of August 16, 2019, VII-Verg 56/18, juris; Munich Higher Regional Court, decision of June 11, 2007, Verg 6/07, juris, para. 31). A minimum of substantiation must be observed; Pure assumptions about possible award violations are not sufficient (OLG Karlsruhe, decision of May 21, 2021, 15 Verg 4/21, juris, para. 28; OLG Brandenburg, decision of May 29, 2012, Verg W 5/12, juris, para. 4; Munich Higher Regional Court, decision of August 2, 2007, Verg 7/07, juris, para. 15 f.).
