OVG Bautzen - 3 B 357/20
| OVG Bautzen - 3 B 357/20 | |
|---|---|
 | |
| Court: | OVG Bautzen (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5 GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 6(2) GDPR Article 6(3) GDPR |
| Decided: | 11.11.2020 |
| Published: | |
| Parties: | Freistaat Sachsen |
| National Case Number/Name: | 3 B 357/20 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Sächsisches Oberverwaltungsgericht - Entscheidungssammlung (in German) |
| Initial Contributor: | Agnieszka Rapcewicz |
Superior Administrative Court Bautzen found that although the Saxon Corona Protection Regulation restricts the apliccant's freedom of occupation and in general the right to private undertakings, guaranteed by the Constutution, it is justified by the protection of life and health of a large number of people. The Court also held that the collection of contact data as a basis for contact tracing is an essential contribution to combating the spread of the pandemic and to prevent significant risks to life and health of people. It therefore serves the interests of the community, which take precedence over the interests of the applicant, who does not want her data to be collected, even if it may be illegal.
English Summary
Facts
With effect from 2 November 2020, the State Ministry of Social Affairs and Social Cohesion has ordered the defendant to adopt the Saxon Corona Protection Regulation. According to this regulation, it is prohibited to open and operate, with the exception of permitted online offers of, among others, establishments providing body-care services, with the exception of medically necessary treatment and hairdressers.
The applicant runs a nail studio and cosmetics company, trades in cosmetic products and holds seminars. The applicant considered that the defendant's legislation was discriminatory, violated the Constitution and personal data protection regulations. Therefore, she lodged a complaint with the Court.
Dispute
Did the defendant have the power to pass the legislation in question, which interferes with the economic life and privacy of citizens? Has the regulation violated the rules of the GDPR, especially the priciple of proportionality?
Holding
The complaint was rejected.
Comment
The main reason for lodging the complaint was the exclusion of the applicant's beauty salon from normal operation. She claimed that the rules introduced by the Saxon Corona Protection Regulation are discriminatory and, moreover, such restrictions and interference with citizens' privacy can only be introduced by rules issued by Parliament and not by the defendant (Freistaat Sachsen). Additionally, the applicant also complained of a breach of the GDPR, in particular, the principle of data minimisation laid down in Article 5 GDPR.
The Court, referring to the alleged violation of the provisions of the GDPR, pointed out that Article 6(1)(c) GDPR and Article 6(1)(e) GDPR allow processing of personal data, if the processing is necessary to fulfil a legal obligation. Furthermore, the processing of personal data is permitted to the extent necessary for the performance of a task in the public interest or in the exercise of official authority. In turn, Article 6(2) GDPR empowers Member States to adopt more detailed rules in this regard. Article 6(#0 GDPR further provides that the legal basis for processing operations under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR shall be determined by Union law or by the law of the Member State to which the person responsible is subject. The purposes of the processing must be laid down in that legal basis or, in respect of processing under Article 6(1)(e) GDPR - it must be necessary for the performance of a task which is in the public interest or in the exercise of official authority vested in the person responsible. This legal basis may include specific provisions aimed at adapting the application of the provisions of the GDPR, including those concerning the general conditions governing the lawfulness of data processing by a Member State.
The Court held that the Saxon Corona Protection Regulation is indeed a sector-specific national law of the Land legislature concerning the processing of personal data which contains more detailed provisions in accordance with Article 6(2) GDPR and Article 6(3) GDPR for adaptation to the application of Article 6(1)(c) GDPR and Article 6(1)(e) GDPR.
The court stressed that national legislation must comply with constitutional requirements. Whether or not it was possible to regulate the processing of personal data in the area of contact tracing by means of a regulation is an open-ended question, and this is a matter of dispute in the case-law.
The Court stated that provisions of the regulation meet the specific data protection requirements. They define in concrete and normative terms who is to collect and store the data, for which reason data must be collected, which data to collect, and, where appropriate, to be communicated to the competent authorities (name, telephone number or e-mail address and postcode of visitors and the period of the visit), how long the data must be stored (for one month after the end of the visit) and that they must subsequently be deleted, the purpose for which the data must be deleted, who is responsible for the transmission of these data (the authorities responsible for infection control), the purpose for which this transmission may be requested (to track infections) and how misuse of the data is prevented (by order of the protection against inspection by third parties and by prohibition of processing for other purposes, unless otherwise provided for by federal law).
The Court found that the collection and processing of contact details also complies with the principle of proportionality. It is suitable and necessary to enable the tracing of contacts of corona infected persons and thus make a significant contribution to prevent the transmission of the virus.
The Court pointed out that the applicant complaint of a breach of the requirement to minimise data has not been further explained. Which of the data to be collected should not be necessary for contact tracing is not apparent in any other way either. Doubts may arise in this respect with regard to the visitor's postcode, which may, however, also be relevant for identification purposes if e-mail or phone number should be illegible.
In the end, the Court found that the collection of contact data as a basis for contact tracing is an essential contribution to combating the spread of the pandemic and to prevent significant risks to life and health of people. It therefore serves the interests of the community, which take precedence over the interests of the applicant, who does not want her data to be collected, even if it may be illegal.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
