LG Wiesbaden - 3 S 50/21
| LG Wiesbaden - 3 S 50/21 | |
|---|---|
 | |
| Court: | LG Wiesbaden (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 2(2) GDPR Article 4(8) GDPR Article 15 GDPR Article 28 GDPR |
| Decided: | 30.09.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 3 S 50/21 |
| European Case Law Identifier: | ECLI:EN:LGWIESB:2021:0930.3S50.21.00 |
| Appeal from: | AG Wiesbaden 93 C 2338/20 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Bürgerservice Hessenrecht (in German) |
| Initial Contributor: | Giel Ritzen |
The Regional Court of Wiesbaden held that data processing under private law no longer exists if a landlord passes on data to a company for the purpose of creating a utility bill. The company then acts as a processor.
English Summary
Facts
This dispute arose during another an eviction dispute between data subject and their landlord (who is the controller). After controller commissioned A GmbH to prepare a cost statement, the company concluded that data subject had to pay an additional € 720,80. During the original dispute, the data subject filed an access request pursuant to Article 15 GDPR. The controller rejected this request because they were merely a private landlord who did not store any data. The data subject, however, claimed the landlord is a controller because their personal data were processed by company A to prepare the cost statement, and the landlord communicated with the data subject via WhatsApp and had therefore stored their phone number.
The District Court of Wiesbaden acknowledged the data subject’s claim. It held that the data subject’s personal data was clearly processed, and that none of the exceptions of Article 2(2) GDPR applied. Hence, it concluded the landlord violated Article 15 GDPR.
The landlord filed appeal against this decision.
Holding
The Regional Court of Wiesbaden rejected the appeal.
It held that the landlord is not merely acting privately because they commissioned company A GmbH to prepare a cost statement. At that moment, the personal data is further processed by this company for the landlord. Hence, that company acts as a processor in accordance with Article 4(8) and Article 28 GDPR, and the landlord must, as controller, comply with the access request pursuant to Article 15 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Court: Wiesbaden Regional Court 3rd Civil Chamber
Date of decision: 30.09.2021
Reference: 3 S 50/21
ECLI: ECLI:DE:LGWIESB:2021:0930.3S50.21.00
Document type: Judgment
Source: Hesse
Standard: 15 DSGVO
Document tab
KurztextLangtext
On the scope of application of the General Data Protection Regulation
Editorial
Data processing in the context of a tenancy agreement
Guiding Principle
Data processing under private law no longer exists if a landlord passes on data to a company for the purpose of drawing up a service charge statement. The company then acts as a processor pursuant to Article 4(8) and Article 28 of the GDPR.
Hide course of proceedingsCourse of proceedings
Previous AG Wiesbaden, 26 April 2021, 93 C 2338/20 (22), Judgment
Tenor
The defendant's appeal against the partial judgment of the Wiesbaden Local Court of 26 April 2021 is dismissed at the defendant's expense.
With regard to the originally asserted information about the origin of the data, it is determined that the legal dispute is settled on the merits.
The defendant shall bear the costs of the appeal proceedings.
The judgement is provisionally enforceable.
The appeal is not admitted.
Reasons
The defendant's appeal against the partial judgment of the Wiesbaden Local Court of 26 April 2021 is admissible, in particular it was filed in due form and time and is well-founded; in the result, however, the appeal is not well-founded.
With regard to the factual findings, reference can be made to the judgement of the Local Court; there were no changes to this in the course of the appeal proceedings.
The legal assessment of the Local Court is also not objectionable in the result. The plaintiff is entitled to the asserted claim for information pursuant to Article 15 of the General Data Protection Regulation (GDPR), originally to the extent as stated in the operative part of the judgement of the Local Court. During the appeal proceedings, the plaintiff declared the claim to be settled insofar as it related to the origin of the data. In this respect, however, the claim had originally been well-founded and the corresponding finding had to be made in favour of the plaintiff, with the costs being borne by the defendant.
The plaintiff is entitled to information pursuant to Section 15 of the GDPR; the District Court correctly determined that the scope of application of the GDPR is open here. Pursuant to Article 2(1) of the GDPR, there is both automated processing of personal data of the plaintiff by the defendant, her husband and the company XXX and processing of data stored in a data system. The defendant cannot refer to the fact that she only filed a rental agreement in her files, i.e. that she only acted privately. This is already contradicted by the fact that the defendant does not merely rent out a flat privately; in this case, it could still be assumed that only the data from the tenancy agreement, which was collected according to the information of the respective tenant, is actually processed. However, this would also require that further processing of the data, for example the preparation of a service charge statement, is also only carried out in the private sphere by the landlord. This is indisputably not the case here. The plaintiff has therefore passed on data to the company XXX for processing with regard to the service charge statement. The company XXX carries out IT-supported processing, as can be seen from the service charge statements prepared in this respect. Thus, data processing is taking place here, and the company XXX was active as a processor in accordance with Article 4 number 8, Article 28 DSGVO. However, the responsible party in the sense of the General Data Protection Regulation is the defendant pursuant to Article 4 number 7 DSGVO. The latter decides vis-à-vis the company XXX on the purposes and means of data processing. From this it is already clear that the defendant does not merely process private data, but passes it on accordingly. Data processing also already existed in the fact that the defendant provided the plaintiff's contact details to his husband so that he could contact the plaintiff. In contrast, it is not relevant for the right to information whether the defendant itself is processing data here. In any case, it has the corresponding responsibility towards the plaintiff, so that the claim for information against it was also justified.
In this respect, reference can be made to the correct and detailed descriptions in the judgement of the lower court.
The claims for information cannot be regarded as an abuse of rights. Precisely because of the aforementioned disclosure of data to the husband or the company XXX, information must also be provided as to whether data has been disclosed to other third parties. In the given situation, it is not possible for the plaintiff to conclusively determine whether data was only passed on to these two recipients or also to corresponding third parties. In case of doubt, the plaintiff as tenant has no insight into how the tenancy is actually handled by the defendant, who receives which data, who processes which data. It is precisely this that constitutes a justified right to information, so that there can be no question of abuse of rights here.
The defendant's assertion that the plaintiff had already been informed accordingly before the action was filed in the present proceedings, referring to parallel proceedings concerning the termination of the tenancy, does not show from the submitted judgement in the proceedings that the question of providing information had been an issue here or had been decided on. How and to what extent the defendant in the parallel proceedings would have actually provided the requested information in accordance with the requirements of the General Data Protection Regulation is thus also not comprehensible.
Accordingly, the plaintiff's claim for information continues to exist, and the defendant, as the unsuccessful party, must bear the costs of the appeal proceedings pursuant to § 97 ZPO.
The decision on provisional enforceability results from § 708 no. 10 in conjunction with § 711 ZPO. In conjunction with § 711 ZPO.
The appeal was not admissible, as the legal requirements for this were not fulfilled.
