OLG München - 18 U 1697/21 Pre
From GDPRhub
| OLG München - 18 U 1697/21 Pre | |
|---|---|
 | |
| Court: | OLG München (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 17 GDPR Article 17(1) GDPR Article 17(1)(c) GDPR |
| Decided: | 22.03.2022 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 18 U 1697/21 Pre |
| European Case Law Identifier: | |
| Appeal from: | LG München I 41 O 7178/20 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Bayerische Staatskanzelei (in German) |
| Initial Contributor: | lacrosse |
Higher Regional Court of Munich corrected a decision of a lower court and dismissed a data subjects claim for an injunctive relief, for which she was entitled due to Article 17 GDPR, because the controller's initial data processing was lawful and therefore no potential risk of recurrence could be implied.
English Summary
Facts
The data subject is a freelance artist. She is in a dispute with Google Ireland Limited about her entry in Google Local Listing. On her website she disclosed information about her private life, including personal data such as phone number and address. A Google service called Local Listing processed the information from that website and disclosed them on Google Maps or in a sidebar in Google Search. The data subject used a web form provided by Google LCC and requested the deletion of the entry.
The deletion request was ignored at first by the defendant. Subsequently, the data subject's attorney submitted a written warning and an injunctive relief. The data subject also demanded the compensation of her attorneys fees. Google subsequently deleted the entry without signing the injunctive relief and without compensation. The data subject argued that the disclosure of her personal data occurred without her cooperation and that data protection law entitled her to receive an injunctive relief from the defendant.
The lower regional court in Munich (Landgericht München I) took the view that, although the data subjects demand of deletion was justified, Article 17(1) GDPR supported no indemnification claim – the court rejected her demand of compensation. The court decided further that Article 17(1) GDPR is not only an entitlement of removal, but also an entitlement of injunctive relief, because an injunctive relief could counter a potential risk of recurrence. Therefore, the data subject is entitled to demand an injunctive relief. The lower court convicted the defendant to refrain from any future disclose the personal data of the data subject in the Local Listing service. The defendant appealed the decision of the lower court.
Holding
The Higher Regional Court Munich (Oberlandesgericht München) corrected the decision of the lower court and dismissed the data subjects claim for an injunctive relief.
The Higher Regional Court clarified that Article 17 GDPR could indeed, in a particular case, entitle a data subject to receive an injunctive relief. The right of erasure according to Article 17(1) GDPR support the claim that erased data won’t be processed again. The court argued that the defining attribute of an injunctive relief is a potential risk of recurrence. But, in the case at hand, the initial processing of the data subjects data in Google Local Listings was considered lawful by the court, until the request of erasure was submitted by the data subject. The defendant deleted the data after the request.
Data processing under Article 6(1)(f) GDPR is considered lawful, if it is necessary to fulfil the legitimate interest of a data controller and at the same time don’t infringe the fundamental rights and freedoms of a data subject.
First, the court held that the data subject disclosed personal data on her website and therefore had no interest to keep her address and phone number secret. The controller could therefore initially assume, that the data subject agreed with the disclosure of her personal data in the Local Listing. The court argued that this is the defining factor for the balancing act under Article 6(1)(f) GDPR.
Second, the court decided that Article 17(1)(c) GDPR obliged a data controller to delete personal data when a data subject actively objects the processing. The data controller is not obliged to proactively verify search engine results.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Title:
Personal data, risk of repetition, DS-GVO, injunctive relief, basic data protection regulation, non-pecuniary disputes, provisional enforceability, responsibility, charter of fundamental rights, legitimate interest, cost decision, disruptive property, data processing, statement of defense, legal person, processing of personal data, safeguarding uniform jurisdiction, injunctive relief, Organizational obligation, decision of the Court of Appeal
Guiding principles:
1. The right to erasure of personal data pursuant to Art. 17 Para. 1 GDPR includes the right to the erased data not being processed again. Art. 17 DS-GVO can therefore also grant the person concerned a corresponding claim for injunctive relief in individual cases.
2. There is no apparent organizational obligation on the part of the company operating an Internet search engine to ensure that e-mails addressed to other legal entities in the same group are forwarded to them in a timely manner. The company operating an internet search engine is therefore generally obliged to immediately delete the disputed personal data in accordance with Art. 17 Para. 1 DS-GVO from the point in time at which it was requested to delete it itself. If this request is complied with immediately, both the disruptive nature and the risk of repetition, which constitutes a claim for injunctive relief, are absent.
Keyword:
GDPR
Lower court:
LG Munich I, final judgment of February 26, 2021 – 41 O 7178/20
Findings:
BeckRS 2022, 16827
ZD 2022, 563
LSK 2022, 16827
tenor
I. Upon the defendant's appeal, the final judgment of the Munich I Regional Court of February 26, 2021, corrected in the facts by decision of April 1, 2021, Az: 41 O 7178/20, is amended so that the action is dismissed.
II. The plaintiff bears the costs of the legal dispute.
III. The judgment is provisionally enforceable.
IV. The revision is not admitted.
Reasons for decision
(abbreviated according to § 540 paragraph 2, § 313a paragraph 1 sentence 1 ZPO)
1
The appeal of the defendant is admissible and justified.
2
Contrary to the view of the district court, the plaintiff has no claim under Art. 17 (1) GDPR that the defendant refrains from publishing the private address of the plaintiff or her telephone number if this happens as in February 2020 under the URL https://www. ...
3
1. The regional court correctly recognized that Art. 17 DS-GVO can also grant the person concerned a claim for injunctive relief in individual cases. The opposing legal view of the defendant cannot be followed. The right to erasure of personal data pursuant to Art. 17 Para. 1 GDPR includes the right to the erased data not being processed again. If the person responsible - like the defendant in the present case - has already deleted the personal data, the claim for omission of future processing can be asserted independently if there is a necessary risk of repetition.
4
a) The Federal Court of Justice has already ruled in its judgment of July 27, 2020 (Az: VI ZR 405/18, BGHZ 226, 285) that a request for legal protection aimed at permanently delisting objectionable search results is generally covered by Art. 17 (1) DS-GVO becomes. This does not conflict with the fact that the technical implementation of such a request may not be limited to the one-off deletion of data, but requires further measures to prevent the information in question from being indexed again under the search term in question.
5
The concept of deletion within the meaning of Art. 17 Para. 1 DS-GVO is to be interpreted autonomously. The "right to erasure" laid down in the regulation is not to be narrowed down to the simple deletion of data due to the technical requirements of the objected data processing, which are ultimately unpredictable for the person concerned and are also subject to constant development progress, but - according to the target-oriented further article heading - as "right to be forgotten” is to be understood normatively, so that the person affected by a search engine also has the right to be delisted (cf. BGH loc.cit., para. 17, quoted from juris). In the case decided by the Federal Court of Justice, the plaintiff's objective of legal protection was expressly formulated as a request for injunctive relief (cf. loc.cit., para. 1).
6
b) The defendant itself states that the right to erasure of personal data pursuant to Art. 17 (1) GDPR applies in the future and grants a right that the erased data may no longer be processed (reason for appeal, p. 3 f. = p. 83 f.d.A.). Since according to Art. 21 Para. 1 Sentence 2 DS-GVO the person responsible is no longer allowed to process after an objection by the person concerned and according to Art. 6 Para. 1 DS-GVO the processing of personal data is only permissible under certain conditions, this means the reverse that processing may no longer take place in the future (ibid., p. 3 f. = p. 83 f. of the case). It is not clear why the person concerned should be prevented from having this ban enforced by bringing an action for an injunction if the person responsible has already complied with the request for deletion, but there is a risk of repetition.
7
2. In the present case, however, both the defendant's disruptive nature and the risk of repetition, which constitutes a claim for injunctive relief, are missing. Because the data processing complained of by the plaintiff - the reproduction of her private address and telephone number under the "Local Listings" - was lawful at least up to the plaintiff's request for deletion, which the defendant complied with immediately.
8th
As the operator of a search engine, the defendant is not obliged to proactively check the content of the evidence generated by its search engine (cf. BGH, judgment of July 27th, 2020 - VI ZR 405/18, BGHZ 226, 285, para. 19 with further references. ). The defendant can only become a disruptor if it is sufficiently clearly informed in formal terms that the data processing is unlawful from the point of view of the data subject and is requested to delete it by naming the result links specifically objected to and a coherent description of the underlying facts and the associated legal considerations (cf. BGH loc.cit.). If she complies with the request immediately, there is no unlawful interference that could justify the disturbance - and the risk of repetition required for a claim for injunctive relief (cf. Grüneberg-Herrler, BGB, 81st ed., § 1004 marginal number 32 with further references).
9
a) Pursuant to Article 6 Paragraph 1 Sentence 1 lit. f GDPR, the processing of personal data is lawful, among other things, if it is necessary to protect the legitimate interests of the person responsible, provided that the interests or fundamental rights and freedoms of the data subject are not violated that require the protection of personal data prevail.
10
The right to the protection of personal data does not apply without restriction, but must - as explained in the fourth recital of the General Data Protection Regulation - be seen with regard to its social function and be weighed against other fundamental rights while maintaining the principle of proportionality (Federal Court of Justice, judgment of July 27th, 2020 - VI ZR 405/18, BGHZ 226, 285, para. 23, quoted from juris, with reference to ECJ, judgment of 09/24/2019 - C-136/17, NJW 2019, 3503, para. 57). This weighing of fundamental rights is based on all relevant circumstances of the individual case and taking into account the severity of the encroachment on the fundamental rights of the data subject on the one hand, the fundamental rights of the person responsible for data processing, the interests of its users and the public as well as the fundamental rights of the provider of the objected On the other hand, to comprehensively carry out the proven content of the result links (BGH a.a.O., Rn. 23 with further references).
11
With regard to the comprehensive examination required from a legal and factual point of view, the weighing must always lead to the same result, regardless of whether the weighing process starts with the question of whether the processing of the data is generally to safeguard the legitimate interests of the person responsible or one third party was required (Art. 6 Para. 1 lit. f GDPR), whether the processing of the data of the person concerned was necessary for reasons of substantial public interest (Art. 9 Para. 2 lit. g GDPR) or whether the person responsible can prove compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject (Article 21 (1) sentence 2 GDPR) (cf. BGH loc.cit., Paragraph 24 with reference to ECJ, judgment of September 24th, 2019 - C-136/17, NJW 2019, 3503, marginal number 59, 66; judgment of May 13th, 2014 - C-131/12, NJW 2014, 2257, marginal number. 76).
12
According to the case law of the Federal Constitutional Court, it is not the fundamental rights of the Basic Law that are decisive in the area of regulations that are fully standardized under Union law, but rather the fundamental rights of the Union alone (BGH loc. . The Senate already pointed out at the time of the appeal that the reference decision of February 10, 2022 (page 94/99 of the case file), in which it had weighed up the fundamental rights of the parties under the Basic Law on a case-by-case basis, should be corrected on this point.
13
b) In the present case, the plaintiff's fundamental rights to respect for private and family life from Art. 7 of the Charter of Fundamental Rights of the European Union (GRCh) and to the protection of personal data from Art. 8 GRCh must be weighed up. The defendant's interest in providing its users with contact information for the respective location under the "Local Listings" as part of the geolocation service it operates is protected by its fundamental right to entrepreneurial freedom in accordance with Art. 16 GRCh.
14
In the present case, the fact that the defendant not only took the personal data it processed from generally accessible sources, but even the plaintiff's own website, is of decisive importance for the result of the weighing up to be carried out. According to the defendant's arguments, which remained unchallenged, the plaintiff had, at least in the period from September 2013 to August 2018, given the address and telephone number in the imprint of its website that it now wants to prohibit the defendant from publishing (cf. Annex B 2). The defendant was therefore initially entitled to assume that the plaintiff had no interest in the confidentiality of the contact data she had published herself, but rather agreed to their inclusion in the "local listings".
15
c) The defendant was therefore obliged to immediately delete the disputed personal data pursuant to Art. 17 (1) DS-GVO from the point in time at which the plaintiff had requested it to delete it. Since, based on the arguments of the parties, it can be assumed that the defendant immediately deleted the disputed entries at the request of the plaintiff, it can be left open in the context of the present legal dispute whether the plaintiff has a claim under Art. 17 (1) DS-GVO to their deletion Status.
16
aa) The plaintiff only raised an objection within the meaning of Art. 17 (1) lit inter alia, to refrain from publishing their private address and their private telephone number. After the defendant's submissions remained unchallenged, she received this letter by fax on May 14, 2020 (cf. statement of defense, p. 5 = p. 19 of the case).
17
bb) The plaintiff's e-mail of February 13, 2020 (Annex K 1), on the other hand, did not trigger any examination obligations on the part of the defendant because the plaintiff did not explain in a comprehensible manner that the defendant received this e-mail or that the defendant had to be treated in this way , as if she had received the email.
18
The defendant claims that the e-mail of February 13, 2020, as evidenced by the application form used by the plaintiff, was not sent to her, but to G. LLC. This is an independent company with which the defendant is only connected in the Alphabet Inc. group (cf. statement of defense, p. 4 = p. 18 of the case; brief of December 21, 2020, p. 2 = p. 32 of the case. ).
19
The plaintiff does not deny this, but considers the objection to be irrelevant because the so-called "local listing" also appears to an experienced user of the search engine operated by the defendant as a search result - albeit a particularly prominent one. The user is in no way aware that the content allegedly not distributed by the defendant to which the form provided by the defendant allegedly does not refer. Even if this were the case, the defendant would have to ensure that data protection complaints that were submitted using the form would be assigned and processed internally (briefing of December 10, 2020, p. 2 = p. 26 of the case file). .
20
With these statements, the plaintiff fails to recognize that the defendant does not dispute its responsibility for the publication of the "local listings", but rather the receipt of the e-mail of February 13, 2020 - addressed to another legal entity. There is no apparent organizational obligation on the part of the defendant to ensure that e-mails addressed to other legal entities in the group are forwarded to them in a timely manner. According to its submission, which has remained unchallenged, the defendant is not the parent company of the group (cf. brief dated February 23, 2021, p. 2 = p. 36 of the file). It therefore has no coordination obligations with regard to the individual companies belonging to the group.
21
The plaintiff has also not explained in a comprehensible manner that the defendant, through a misleading design of its forms or other communications, had caused the plaintiff to contact the non-responsible G. LLC with her e-mail of February 13, 2020. Last but not least, the fact that the lawyer's letter of May 7th, 2020 (Annex K 2) is correctly addressed to the defendant ("G. Ireland Ltd.") speaks against this.
22
cc) In response to the lawyer’s letter dated May 7th, 2020, the defendant undisputedly deleted the disputed entry under “Local Listings”. The plaintiff has not explained in a comprehensible manner that the defendant reacted to the request belatedly.
23
The word “immediately” used in Art. 17 Para. 1 Sentence 1 DS-GVO means “without culpable hesitation” according to the legal definition relevant for German law in Section 121 Para. 1 Sentence 1 BGB. There are no indications that the word could have a different meaning in the context of the General Data Protection Regulation. In principle, the defendant is to be granted a reasonable examination period. According to the case law of the Senate, the deadline for removing illegal content regulated in Section 3 (2) sentence 1 no. 3 NetzDG after receipt of a complaint can regularly be used to specify this. According to this, illegal content - apart from the special case of obviously illegal content that is not relevant here - must be removed within seven days of receipt of the complaint.
24
Based on this standard, the defendant cannot be accused of having reacted too late to the plaintiff's request for deletion of May 7, 2020. According to the unchallenged submissions of the defendant, the request was only received on May 14, 2020. Her reply, in which she announces that the plaintiff's complaint will be examined, is dated May 19, 2019 (Annex K 3). In the period that followed, the contested entry was undisputedly deleted. Since the plaintiff does not communicate the specific time of deletion, it is to be assumed in favor of the defendant that the deletion took place within a period of seven days after receipt of the request for deletion by the defendant.
25
1. The decision on costs is based on § 91 ZPO.
26
2. The decision on the provisional enforceability finds its legal basis in § 708 No. 10 analogously, § 713 ZPO. The lawsuit is about a non-pecuniary dispute; however, the appeal judgment is only enforceable in terms of costs.
27
3. The revision is not admitted because the legal matter is neither of fundamental importance nor does the further development of the law or the safeguarding of uniform case law require a decision by the court of appeal (§ 543 Para. 2 Sentence 1 ZPO). The legal questions raised by the present legal dispute have already been sufficiently clarified by the cited Supreme Court case law.
