LG Köln - 28 O 221/21
From GDPRhub
| LG Köln - 28 O 221/21 | |
|---|---|
 | |
| Court: | LG Köln (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 17(1)(a) GDPR Article 17(1)(d) GDPR |
| Decided: | |
| Published: | 16.02.2022 |
| Parties: | SCHUFA Holding AG |
| National Case Number/Name: | 28 O 221/21 |
| European Case Law Identifier: | ECLI:DE:LGK:2022:0216.28O221.21.00 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Justiz NRW (in German) |
| Initial Contributor: | lacrosse |
The Regional Court of Cologne rejected a request to erase a negative entry in a credit report agency database and further to adjust a low credit score. The data processing is lawful and outweighed the data subjects individual interests.
English Summary
Facts
The controller is the German private credit report agency “SCHUFA Holding AG”. It provides information about the creditworthiness of consumers to SCHUFA contract partners, with the aim to protect them from credit risks. SCHUFA contract partners could use the information to advise would-be borrowers about existing financial obligations, thus debt overload could be avoided. To achieve the purpose to mitigate credit risks, SCHUFA receives relevant data from their contract partners, about how reliably a customer meet it’s financial obligations. From that data SCHUFA infer a credit score for a certain individual. A low credit score is essentially a low creditworthiness, which leads to difficulties for the individual to get e.g. a new phone contract or new bank loan.
The data subject is a consumer with a low credit score and a discharge of residual debt. The SCHUFA file of the data subject contains an obligation of €40.000. A residual debt exemption was granted by an insolvency court – which terminates the obligation. SCHUFA added the information about residual debt exemption to its data entries. The information contains file number, date and the information, that a residual debt exemption was granted. This information will be deleted after three years (in the year 2023). Data subject requested erasure of the database entry and further requested to realign the credit score. The defendant refused to erase the data and to adjust the credit score.
In the time since the residual debt exemption was granted and the lawsuit was filed, there was no request by a SCHUFA partner about the data subject.
Holding
The Regional Court of Cologne (Köln) rejected the complaint. The Court found that the data processing by SCHUFA was lawful and is still necessary in relation to the purposes. Therefore, the Court ruled that the data subject could not invoke it's Right of Erasure under the Article 17(1)(a) and Article 17(1)(d) (d). Data processing by the defendant is still lawful, because it is permitted by [[Article 6 GDPR#1f|Article 6(1)(f)]. The legitimate interest of the SCHUFA contract partners override the data subjects interests. The Court further explained that the information requests by the contrcat partners are necessary to fill the information gap between creditor and the potential credit user. The information that a residual debt exemption was granted is therefore a relevant creditworthiness information – before the residual debt exemption was granted the data subject have not meet it’s financial obligations. For the same reason the Court dismissed the data subjects request to adjust the credit score.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
The defendant is a joint institution of the lending German economy. The defendant's task is to provide its contractual partners with information that is suitable for protecting them from losses in credit-related transactions. At the same time, the information opens up the possibility for the defendant's contractual partners to protect those interested in credit-related transactions from excessive debt by providing advice. For this purpose, the defendant's contractual partners transmit relevant data from the business relationships with their customers. The defendant stores the data transmitted to it in order to provide its contractual partners with information if they assert a legitimate interest in receiving it. Before concluding a credit-relevant transaction, the defendant's contractual partners can use the information and other information available to the contractual partner to check what risks the prospective transaction entails.
3
The plaintiff is 31 years old and has lived with his wife in a small apartment in L since May 2020. He has had a current account with T since December 2020 and works as a permanent seller.
4
On October 6th, 2020 he was granted an exemption from residual debt. The defendant then copied the following entry about the plaintiff into its file:
5
"Residual debt exemption granted This information comes from the publications of the insolvency courts. We were informed of the granting of the residual debt exemption for these insolvency proceedings. File number: 00000 The process is managed by the insolvency courts under this file number. Date of the event: 06.10.2020"
6
The post will be deleted after three years, i.e. on October 6th, 2023. In the defendant's database, claims in the amount of more than EUR 45,000.00 were previously documented, which were marked as settled with the granting of the discharge from residual debt and are no longer displayed. From the time the residual debt was released until the lawsuit was filed, the defendant had not received any inquiries from potential landlords, mobile phone companies or energy suppliers about the plaintiff's data.
7
In a letter from a lawyer dated February 9th, 2021, the plaintiff, setting a deadline of February 23rd, 2021, lodged an objection with the defendant against the processing of his personal data and requested the defendant to delete it. In a letter dated March 5th, 2021, the defendant rejected the deletion.
8th
The plaintiff claims that he is seriously looking for a flat with his partner because the previous flat is too small for starting a family. He could afford a larger apartment with his income. The entry prevents the renting of a larger apartment. A real estate loan was therefore not granted to him. He could also not open a new current account because of the entry. The opening of an account with E and D failed because of the entry. He would also not find a new job as a salesman because of the entry. He also couldn't sign a new mobile phone or energy supplier contract, even if he could save costs if he wanted to. This whole situation is detrimental to his health.
9
The plaintiff is of the opinion that the district court has subject matter jurisdiction. Since his economic existence is threatened, the amount in dispute is to be set at at least 10,000 euros for application 1), for application 2) at 5,000 euros. The plaintiff claims that he has a right to erasure based on Article 17(1)(a) GDPR against the defendant. Since the discharge of the residual debt had been granted, the defendant was no longer interested in the storage of his data. After all, the plaintiff no longer owed anything. The defendant cannot hold up its own economic interests to the plaintiff. In turn, an economic restart is made impossible for him. However, this is the objective of the insolvency code, the rules of which are conclusive in this respect. A regulation for data processing is not included there. The defendant is trying to circumvent these standards and to sanction the plaintiff for the discharge of the residual debt. The T entry is also not to be compared with the insolvency notice. The defendant also violated its obligations under Art. 5 DS-GVO. There is also a claim based on Art. 17 (1) c), since the plaintiff has lodged an objection to the processing of the data. His interests justify a special personal situation according to Art. 21 Para. 1 DS-GVO.
10
The plaintiff requests
11
1. to order the defendant to disclose the information stored in its electronic database (computer): "Residual debt exemption granted This information comes from the publications of the insolvency courts. We were informed of the granting of the residual debt exemption for these insolvency proceedings. File number: 00000 The process is managed by the insolvency courts under this file number. Date of the event: 06.10.2020" to be deleted.
12
2. to order the defendant to restore the plaintiff's score value in such a way as if the storage made under application 1) had not existed.
13
The defendant requests
14
reject the complaint.
15
The defendant is of the opinion that the discharge of the residual debt does not serve to enable the plaintiff to take on new debts, but should prompt potential lenders to specifically check the plaintiff's creditworthiness. It must be taken into account that there was massive debt before the residual debt was discharged, which still needs to be explained to a lender. Therefore, the entry is still necessary within the meaning of Article 17 (1) (a) GDPR. The storage period of three years is also appropriate and transparent within the meaning of Article 5(1)(e) GDPR. The Code of Conduct, to which the defendant is obliged and which regulates this duration, was agreed with the data protection supervisory authority responsible for the defendant, the G. There is also no special situation within the meaning of Art. 17 Para. 1 lit. c), 21 Para. 1 S. 1 DS-GVO. The plaintiff was able to find a new apartment during the good conduct phase, although the ongoing insolvency proceedings were still registered with the defendant at that time. On December 30, 2020, i.e. despite the existence of the disputed entry, T reported the opening of a new current account for the plaintiff. Even if the conditions alleged by the plaintiff were correct, the difficulties described would correspond to the "normal course of events" after insolvency proceedings. Alternatively, the general interests would outweigh the interests of the plaintiff despite the special situation. A claim for recalculation of the score value is also not apparent. It would also be superfluous, since the defendant automatically recalculates the score after each deletion of an entry.
16
Reasons for decision:
17
The admissible action is unfounded.
18
I
19
The lawsuit is admissible. The district court of Cologne is responsible for this. Irrespective of the specific amount in dispute, the jurisdiction of the regional court results from § 39 ZPO, because the representative of the defendant negotiated the main issue orally without asserting the lack of jurisdiction.
20
II.
21
The lawsuit is unfounded.
22
1.
23
The plaintiff has no claim against the defendant for the deletion of the entry of his discharge of residual debt from Article 17 (1) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th, 2016 for the protection of natural persons with the processing of personal data, free of charge data traffic and to repeal Directive 95/46/EC (General Data Protection Regulation, GDPR).
24
a) A claim does not arise from Article 17 (1) (a) or (d) GDPR, because neither the storage of the data nor the further processing by the defendant was unlawful from the start, nor is the further processing of the data are no longer necessary for the purposes for which they were collected.
25
The collection, storage and (potential) disclosure of information about the plaintiff is processing of personal data by the defendant in accordance with Art. 4 GDPR. This is the “responsible person” within the meaning of Art. 4 No. 7 GDPR. It is undisputed that the plaintiff did not give his consent (Art. 6 Para. 1 lit. a) GDPR). Whether the defendant performs a task in the public interest or in the exercise of public authority (cf. Art. 6 Para. 1 lit. e) GDPR) is irrelevant. In case law, a public interest in the credit reporting procedure of the defendant has long been recognized (Federal Court of Justice, judgment of July 7th, 1983 - III ZR 159/82; Wiesbaden Regional Court, judgment of September 14th, 2016 - 8 S 29/15; Würzburg Regional Court, judgment of 21.03.2016 - 71 O 1216/15). In any case, there is no separate legal basis required for data processing in accordance with Article 6(1)(e) GDPR in accordance with Article 6(3)(1)(b) GDPR (OLG Schleswig, judgment of July 2nd, 2021 - 17 U 15/21, NZI 2021, 794; Cologne Higher Regional Court, judgment of January 27, 2022 - 15 U 153/21, BeckRS 2022, 1208, para. 17).
26
However, the data processing by the defendant is lawful because it is permissible under Article 6(1)(f) GDPR. There is a "legitimate interest" of the defendant's contractual partners in the data processing, which outweighs the interests and fundamental rights of the plaintiff.
27
The defendant gives its contractual partners information if they want to conclude credit-related transactions with a person. This information is required to compensate for the information disparity between lenders and borrowers (OLG Köln, loc.cit., para. 18 ff.). Otherwise, the lenders would only have to rely on the self-declaration of potential borrowers. The processing of the data by the defendant essentially serves to enable lenders to make an accurate and objective assessment of the creditworthiness of a potential contractual partner and thus to secure legal and credit transactions in Germany as a whole, especially since lenders are obliged under the relevant statutory provisions to to form a viable picture of the resilience of their respective contractual partners (especially in the consumer area). Contrary to a reading that is represented by the OLG Schleswig (OLG Schleswig, loc. cit., NZI 2021, 794), it is not important whether it is already certain (namely) whether and, if so, who enters into which specific contractual or pre-contractual relationships with the person concerned wool. Because even a rather abstract interest in information and the general need in credit transactions for the possibility of obtaining information form a typical, sufficiently identifiable interest that regularly occurs in the case of the granting of a loan (OLG Köln, loc.cit., para. 23).
28
The fact that the assumption of a “legitimate interest” in the data processing would conflict if the information stored by the defendant was not meaningful for creditworthiness and reliability and the information was therefore “worthless” for the defendant’s customers is not specifically the case on the plaintiff’s side did. Especially when it is - as here - (also) about a discharge of residual debt, this is a relevant date for any meaningful credit rating, because the debtor was demonstrably without assets at least at the time of the insolvency, which is also relevant for the rating of his creditworthiness today market can certainly still be of interest. The discharge of residual debt also proves that the debtor was not able to settle due claims within a period of at least six years, although he was obliged to do everything possible to pay off his debts in the good conduct phase according to §§ 287b, 295 InsO; According to the market assessment, this also has a certain relevance for the assessment of his current creditworthiness, which is nothing more than a pure forecast decision by the lender. It is therefore difficult to understand why the plaintiff was unable to settle his old debts over a period of six years, but wants to be able to meet new liabilities by being granted the discharge of residual debt. The plaintiff is not stigmatized by the disputed information about his discharge of residual debt. Rather, it is the right and duty of potential lenders to objectively assess the plaintiff's selection risk. The plaintiff demands equality with persons who have never been affected by insolvency. However, he does not have this right. If the defendant were obliged to delete the disputed entry, it would inform its contractual partners that it had no recent knowledge of the plaintiff's unreliability in the settlement of claims, which would be wrong.
29
However, unlike the old version of the BDSG, the GDPR itself does not contain any specific regulations or maximum limits for the duration of the storage of personal data, but rather links the legality of further processing solely to the criterion of necessity and thus to a consideration in the individual case. In this respect, Recital No. 39 of the GDPR stipulates that the storage period for personal data should be limited to the absolutely necessary minimum and that the person responsible - which is only appropriate in bulk transactions such as that of the defendant - should provide deadlines for their deletion or regular review. Art. 40 GDPR offers industry associations the opportunity to specify fields of application with the responsible data protection supervisory authorities through rules of conduct that are binding at least for them and the supervisory authorities. That happened in the present case: The Association of Credit Agencies e.V., to which the defendant belongs, has "rules of conduct for the checking and deletion periods of personal data by the German credit agencies from May 25th, 2018" (so-called "code of conduct") in the sense of a self-commitment of the members, which have been approved by the competent data protection authority of the state of Hesse in accordance with Art. 40 (5), 55 (1) GDPR in conjunction with Section 40 BDSG. In these rules of conduct, specific checking and deletion periods are listed for the individual personal data of the debtor. The challenged processing of the data for the discharge of residual debt is covered by the deadline regulation (cf. Section II No. 2 b) of the "code of conduct"). On the basis of these regulations, the storage and further processing of the plaintiff's data would (currently) be free of objections, since the relevant 3-year period has not yet expired.
30
The regulations in the "code of conduct" themselves do not offer any material legal basis; they also do not prescribe the weighing in the context of Art. 6 (1) lit. f GDPR and ultimately do not replace the weighing of interests by the courts. However, the code of conduct is to be used and recognized as at least in the normal case a considerable and appropriate balance of interests between the parties involved for data protection-compliant storage of information if - as here - no concrete indications for a different assessment are presented and/or otherwise apparent (OLG Köln, loc.cit., para. 26).
31
Contrary to the position of the Schleswig Higher Regional Court (loc Insolvency announcements on the Internet are to be deleted after six months (OLG Cologne, loc.cit., para. 27). The legal regulation is not directly applicable to entries in the defendant's database, because the storage period stipulated in the regulation only applies to public announcements in the insolvency proceedings. An analogous application is already ruled out in view of the missing (unplanned) regulatory gap. In the last legislative period, an early draft of Section 301 (5) InsO-RefE provided for an express legal regulation with regard to short storage periods for credit bureaus. On the other hand, after concerns about European law had been raised (Thüsing/Flink/Rombey, NZI 2020, 611 ff.), such a regulation was deliberately avoided (BT-Drs. 19/25322, 5, 7) and only an evaluation clause was included in Art. 107a para. 1 sentence 2 EGInsO included in the law.
32
Also from a regulatory point of view, it is not convincing to resort to regulations in national law for the interpretation of the European law regulation in Art. 6 Para. 1 lit Utilization of the statutory opening clauses (also) to Art. 17 GDPR, for example in Art. 23 lit. i and j GDPR (on all this with further reference to Cologne Higher Regional Court, loc. cit., para. 27 et seq.).
33
Even an only indirect consideration of the regulatory content of § 3 InsoBekV within the consideration of Art. 6 Para. 1 lit. f GDPR is ruled out. There is a lack of comparability between the legally regulated situation and the situation at hand here: the circumstances are not comparable in terms of the personal scope and the scope of the respective data processing. On the Internet platform www.insolvenzanzeigeen.de, the entries contained there - which ultimately also deal with government interventions - can be accessed by anyone free of charge and without registration or without demonstrating a legitimate interest. Against the background of this easy retrieval, a maximum storage period of only six months makes sense. A comparable situation does not exist with the storage and processing of data by the defendant. This only provides information to its contractual partners and only to them if there is a “legitimate interest”, i.e. only if they have to check the creditworthiness of the borrower in order to conclude a loan transaction (OLG Cologne, loc. cit.).
34
The plaintiff cannot otherwise raise any overriding personal interests that speak against the appropriateness of the result of the weighing up abstractly prescribed in the "code of conduct" in the specific individual case. In particular, he cannot claim different treatment than a "classic" debtor simply because of the discharge of residual debt.
35
b) Finally, a right to erasure does not result from Article 17(1)(c) Var. 1 i. V. m. Art. 21 Para. 1 DS-GVO. According to this, there is a right to erasure if the data subject objects to the processing pursuant to Art. 21 (1) and there are no overriding legitimate reasons for the processing. The plaintiff undisputedly filed an objection to the processing of personal data concerning him on February 9th, 2021 in accordance with Article 21 (1) DS-GVO. However, he had no right to object. Such is the case if the data subject presents reasons that speak against the processing of the data due to their particular situation, and the person responsible cannot prove any legitimate reasons that outweigh the interests, rights and freedoms of the data subject. These must be reasons that justify an atypical constellation that gives the interests of the person concerned particular weight (cf. Kühling/Herbst, DS-GVO/BDSG, 2nd ed., 2018: Art. 21, para. 15). The plaintiff bears the burden of presentation and proof for the existence of the reasons. Such reasons may not have been adequately presented by the plaintiff.
36
The plaintiff states that he wants to move but cannot find a new apartment because of the entry. However, he does not substantiate the efforts he has made so far and how many rejections he has received as a result of the entry. Rather, the defendant's submission that no landlord has made a specific inquiry about the plaintiff since the registration of the discharge of residual debt has remained unchallenged.
37
He further states that the entry stands in his way when opening a new account. So he could not open accounts with E and D. This objection should not be accepted either. The plaintiff currently has a checking account with T. It is not stated or otherwise apparent that he needs another account. Incidentally, he was able to open this account despite his entries with the defendant. In addition, it is not specifically stated when he actually wants to have applied for the accounts with E and D and when he was specifically refused to open them because of the entry.
38
Insofar as the plaintiff argues that he could not find a new job as a salesman because of the registration, it is not apparent why information from the defendant could be required for an application as a salesman. According to his own statements, the plaintiff is also in a permanent position. He did not state that he was even looking for a job.
39
Insofar as the plaintiff argues that he cannot take out a real estate loan or conclude a new mobile phone or energy supply contract, this does not lead to any different conclusion either. On the one hand, the defendant's submission that no customer inquiries in this regard had been made to the plaintiff remained undisputed. On the other hand, this should not be an atypical, but rather a typical consequence of the discharge of residual debt.
40
However, even assuming a special personal situation of the plaintiff after the granting of the discharge from the residual debt, a claim for deletion could not be affirmed, since the interests of the defendant and its contractual partners in data processing outweigh the stated interests of the plaintiff. Because the credit industry has the obligation to carefully and objectively check the creditworthiness of potential borrowers before granting a loan. The defendant supports the credit companies with their information systems. If she deleted the entry, the plaintiff would be like someone who has never had a residual debt discharge. This does not adequately reflect the plaintiff's credit risk. Something else could only arise if the plaintiff could present and prove circumstances which show that insolvency proceedings were only opened due to a special personal situation which, for certain reasons, cannot be repeated in the future ( such as an illness). However, this is not the case here.
41
2.
42
Based on the above statements, the plaintiff is also not entitled to have the score restored.
43
3.
