VG Mainz - 1 K 473/19.MZ
From GDPRhub
| VG Mainz - 1 K 473/19.MZ | |
|---|---|
 | |
| Court: | VG Mainz (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1) GDPR Article 17(1) GDPR Article 51 GDPR Article 55(3) GDPR Article 77 GDPR § 101 (2) VwGO § 2 (3) DSG RP |
| Decided: | 22.07.2020 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 1 K 473/19.MZ |
| European Case Law Identifier: | ECLI:DE:VGMAINZ:2020:0722.1K473.19.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Justizportal Rheinland-Pfalz (in German) |
| Initial Contributor: | n/a |
A complaint with a DPA must contain all information necessary for the DPA to understand and investigate the facts, confirm jurisdiction and decide on potential breaches of data protection law.
English Summary
Facts
The claimant brought action against the termination of an investigation by the regional DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LFDI).
He had made requests under Art 15 GDPR to a number of regional public authorities - several courts, attorney general’s offices, a ministry and a parliamentary body – but didn’t see his rights under GDPR met, except in one case. In particular, he didn’t feel informed about which information could be deleted.
The claimant referred to a lack of consistency between the regional authorities in the application of Article 15 and a generally too narrow interpretation compared to its application on the national level.
The DPA terminated the investigation with reference to a lack of provision of information by the claimant.
Dispute
Was the termination of the investigation by the regional DPA lawful and, in this context, did the regional public authorities respond adequately to the requests under Article 15 GDPR?
Holding
The court denies admissibility of the claim and dismisses it. It was not possible to investigate the claims and hence confirm the necessary possible infringement of claimants’ rights since he did not provide sufficient information.
Subsequently, the court explains that, had the claim been admissible, it could not have been successful.
It confirms that the regional DPA met its obligation to request missing information from the claimant and that the claimant had not responded to this.
In particular, the court explains, - although no legal expertise or analysis could be expected from him - had the claimant failed to specify which acts or omissions he felt were in breach of which right granted to him under GDPR, in particular Article 15. Not even if or why he was expecting the respective authorities to hold personal data on him, which of his requests had been responded to or not, and why those replies received were in his opinion not satisfactory.
This lack of information also inhibited confirmation of jurisdiction, since it could not be determined by whom exactly the potential personal data in question would actually have been processed. This was particularly relevant since courts (Article 55 (3) GDPR) and a parliamentary body (§ 2 (3) Datenschutzgesetz Rheinland-Pfalz - DSG RP) were involved.
As regards the claimant's statement of not being able to determine which personal data could be deleted, the court concludes that Article 15 (1) (e) GDPR sets an obligation to inform a data subject about the existence of their right to deletion, which had been met in all relevant communications submitted to the court. The court finds that Article 15 (1) GDPR did not entail an obligation to list all personal information in respect to an indication which ones could be deleted according to Article 17 GDPR. The claimant had not asked for copies of his personal information nor had he requested their deletion. Furthermore, the court elaborates, did it not see evidence that the exercise of rights of deletion granted by Article 17 GDPR necessarily require knowledge of the information by the data subject.
Furthermore, the court concludes that there is no way for the claimant to enforce consistent application as such, nor had he provided any information to explain his claim of inconsistent application of Article 15 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Guiding Principle
1. A data protection complaint must contain all the information necessary for the supervisory authority to understand the facts of the case and, if necessary, to clarify them further, to verify its competence and to identify any data protection violations. The complaint must therefore at least contain information about the data subject and the person responsible and at least give some indication of the violation of data protection regulations that is being complained about.
2. The complainant may not request the supervisory authority to conduct an investigation into the matter.
Tenor
The action is dismissed.
Orders the applicant to pay the costs.
The judgment is provisionally enforceable with regard to the costs.
Facts
1
The plaintiff objects to the termination of its data protection complaint procedure by the defendant.
2
In a letter dated February 5, 2019, the plaintiff filed a complaint with the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate - LFDI - alleging violations of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO -. He had asked various authorities (Public Prosecutor's Office Mainz, Social Court Mainz, State Chancellery Rhineland-Palatinate, State Social Court Rhineland-Palatinate, Petitions Committee of the Rhineland-Palatinate State Parliament, Ministry of Justice Rhineland-Palatinate, General Public Prosecutor's Office Koblenz) for information pursuant to Art. 15 of the DSGVO. With the exception of the reply from the General Prosecutor's Office in Koblenz, however, he could not identify from the information provided which documents he could have deleted. He therefore doubted that the replies would comply with the requirements of the DSGVO and that the authorities had sufficiently fulfilled their obligation to provide information.
3
In the course of the subsequent correspondence, the defendant pointed out, among other things, that it was not competent with regard to the judicial activity of courts pursuant to Art. 55 Para. 3 DSGVO and for the Petitions Committee of the State Parliament, insofar as it performed parliamentary duties, pursuant to § 2 Para. 3 Landesdatenschutzgesetz - LDSG (State Data Protection Act). The scope of the right to information under Art. 15 DSGVO was "subject to discussion". The plaintiff's statements would allow the conclusion to be drawn that his right to information had been taken into account by sufficient responses from the various authorities. Insofar as the plaintiff was of the opinion that the answers were insufficient in terms of content, he should specify this in more detail.
4
In his letter dated April 18, 2019, the plaintiff criticized that the various authorities would handle their obligation to provide information differently. The right to information was interpreted and answered more extensively at the federal level. Furthermore, he pointed out the importance of proper record keeping by authorities.
5
By notice dated April 26, 2019, the defendant informed the plaintiff that the complaint proceedings had been terminated because the plaintiff had not communicated any new facts in its letter dated April 18, 2019, but only the grievances that existed in its view and its legal opinion.
6
The plaintiff filed an action on May 2, 2019. The termination of the proceedings was unlawful and not sufficiently reasoned. It was customary in the context of a complaint procedure that the complainant would substantiate the complaint with his own view and present it legally. This could not be taken as a reason to terminate the proceedings. Rather, according to Art. 51 DSGVO, the defendant had to ensure that the state authorities of the state of Rhineland-Palatinate interpreted and handled the right to information under Art. 15 DSGVO in a uniform manner. After having inspected the administrative file, he had had to conclude that the file on sheet 77 had been amended and had not been kept complete and proper. It was not apparent from the administrative file that the authority had sufficiently dealt with the facts of the case. The administrative decision could therefore not be understood on the basis of the administrative file. In addition, he had been wrongly refused permission to take photographs of the file. Furthermore, he was of the opinion that the defendant's statement of defense was time-barred.
7
The applicant claims that the Court should
8
order the defendant, setting aside the defendant's decision of 26 April 2019, to give a new decision on the applicant's complaint of 5 February 2019 in accordance with the legal opinion of the Court of First Instance
9
The defendant claims that the Court should
10
dismiss the action.
11
The action is admissible, but unfounded. The complaint does not let any desire of the plaintiff recognize and contains besides no reason. The plaintiff evaluated essentially his inspection of records. This has however no purchase to the administrative procedure which is here contentious.
12
The application for provisional legal protection filed by the plaintiff on February 19, 2020, was rejected by the Administrative Court of Mainz by order of March 19, 2020 (- 1 L 72/20.MZ -, juris). He withdrew his appeal against the decision of the Administrative Court of Mainz at the Higher Administrative Court of Rhineland-Palatinate (see OVG RP, decision of 4 May 2020 - 10 B 10492/20.OVG -).
13
At the oral hearing on June 18, 2020, the plaintiff declared for the record that he waived a further oral hearing. The defendant declared a corresponding waiver by letter dated June 22, 2020.
14
For further details of the facts of the case and the dispute, reference is made to the defendant's court file and administrative file (1 volume), which were available to the Chamber and were the subject of the hearing on 18 June 2020 and the deliberations on 22 July 2020.
Grounds for Decision
15
The action is neither admissible (I.), nor is it successful in the matter (II.).
16
With the agreement of the parties involved, a decision on the complaint could be made without further oral proceedings (§ 101 para. 2 VwGO). The waiver of an oral hearing is a fundamentally incontestable and irrevocable procedural act (see only OVG Lüneburg, Order of 11 May 2020 - 4 LA 163/18 -, juris, marginal no. 4; Dolderer, in: Sodan/Ziekow, VwGO, 5th ed. 2018, § 101, marginal no. 25). Nor has the plaintiff put forward any grounds for avoidance or revocation.
17
The plaintiff's declared waiver of a further oral hearing was also not "used up" at the time the Administrative Court reached its decision. Because the administrative court did not make any further (material) decision, which preceded the final judgement, after the renouncement of the involved ones on a further verbal hearing (see BVerwG, resolution from 4. June 2014 - 5 B 11/14 -, juris, margin no. 11; OVG Lüneburg, decision of 11 May 2020 - 4 LA 163/18 -, juris, margin no. 5; Brüning, in: Posser/Wolff, BeckOK VwGO, 53rd edition, as of 1 January 2020, § 54, margin no. 15). However, the decisions of 19 June 2020 and 8 July 2020, by which the plaintiff's requests for refusal were rejected, were not such decisions on the merits.
18
It was also not necessary to hold a further oral hearing in order to preserve the plaintiff's right to be heard (see OVG Lüneburg, decision of 11 May 2020 - 4 LA 163/18 -, juris, marginal no. 6 m.w.N.). The plaintiff cannot refer to the fact that an oral hearing has not (effectively) taken place so far because the chamber was not properly staffed and a new oral hearing had to be scheduled. The chamber was duly staffed, since the plaintiff's request for rejection had been rejected by decision of 15 June 2020. It is irrelevant that the plaintiff had not yet received the decision on his request for rejection before the oral hearing on June 18, 2020. In cases of service, the time of dispatch by the court's registry is to be taken into account (see Kopp/Schenke, VwGO, 25th edition 2019, § 54, marginal no. 15). In this case, the order of 15 June 2020 was posted on 17 June 2020, according to the court files.
19
I. The action is already inadmissible.
20
Although the action is in principle admissible as an action for breach of obligations pursuant to § 42 (1) Var. 2 VwGO (German Rules of the Administrative Courts). The balance brought forward by the plaintiff is not permissible pursuant to §§ 133, 157 BGB (analogous) in conjunction with § 88 VwGO to the effect that with his lawsuit he not only wishes to defend himself against the termination of the data protection complaint procedure, but also seeks intervention by the LFDI against the various authorities from which he has requested information. The defendant's letter of 26 April 2019 is an administrative act within the meaning of § 35 sentence 1 of the Administrative Procedure Act - VwVfG - (see VG Mainz, judgment of 16 January 2020 - 1 K 129/19.MZ - juris, marginal no. 26). Insofar as the plaintiff requests a new decision on his complaint or an intervention by the LFDI, he can assert a claim for a decision free of discretionary error. Only in the rare exceptional case that the discretion is reduced to zero can a concrete supervisory measure be claimed (see VG Mainz, judgement of 16 January 2020 - 1 K 129/19.MZ - juris, marginal no. 28 m.w.N.).
21
In any case, the plaintiff is not entitled to bring an action (§ 42 (2) VwGO). Insofar as the action also includes the plaintiff's request for information from the General Public Prosecutor's Office, no infringement of rights is possible and the plaintiff therefore does not have the right to bring an action because he cites the information from the General Public Prosecutor's Office as a "positive example" of a proper response within the meaning of Article 15 of the DSGVO (see for example p. 33, p. 42, p. 47, p. 73 of the Administrative Acts). The plaintiff obviously does not himself assume that his rights have been violated by the information provided by the General Prosecutor's Office. For the rest, the plaintiff did not substantiate either in the complaint procedure or in the complaint procedure in which subjective rights he sees himself violated. If the plaintiff refers to Art. 51 para. 2 sentence 1 DSGVO and demands from the LFDI as supervisory authority the enforcement of a uniform legal application practice of the different authorities, no enforceable legal claim or the violation of a subjective right can be derived in any case. Furthermore, the plaintiff has failed to provide at least a rudimentary justification for his complaint - and, based on this, his claim - in what he sees as a violation of his right to information under Art. 15 DSGVO and why he considers intervention by the LFDI necessary. Without this information, his complaint could not be examined and a violation of rights could not be established in court proceedings (see II. below).
22
II. notwithstanding the above, the lawsuit will not be successful in the substance either. The defendant's decision of April 26, 2019, is lawful and does not violate the plaintiff's rights. The termination by the Defendant of the Complaint Procedure brought by the Plaintiff is not objectionable because the Plaintiff did not bring a verifiable complaint to the LFDI. The deplored one stopped the complaint procedure not for the reason - as the plaintiff probably means -, because the plaintiff communicates only the bad states existing from its view and its legal opinion, but because the complaint of the plaintiff could not be examined by the LFDI for lack of concrete information to a data protection right offence.
23
1. an appeal may be lodged with the supervisory authority - here: Art. 77 para. 1 DSGVO LFDI - if the data subject considers that the processing of personal data relating to him/her is in breach of this Regulation. The complainant not only has the right to receive a reply and a decision on his complaint - as would be the case with a petition - but also has a further right to error-free exercise of discretion and, in the event of a reduction of discretion to zero, a right to specific intervention by the supervisory authority (cf. VG Mainz, judgement of 16 January 2020 - 1 K 129/19.MZ -, juris, marginal 35; VG Ansbach, judgement of 8 August 2019 - AN 14 K 19.272 -, BeckRS 2019, 30069, marginal 25; Albrecht/Jotzo, Das neue Datenschutzrecht der EU, 1st edition 2017, part 8, marginal 6 f., beck-online; Mundil, in Wolff/Brink, BeckOK Datenschutzrecht, 30 Ed. as of 1 February 2017, Art. 78 DSGVO, marginal 7). A complaint can be filed informally, since Art. 77 para. 1 DSGVO does not stipulate any explicit formal requirements. In terms of content, the requirements for the appeal must not be too strict, so that the right of appeal can be exercised simply and unbureaucratically (see Bergt, in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed. 2018, Art. 77, margin no. 10; Körffer, in: Paal/Pauly, DS-GVO/BDSG, 2nd ed. 2018, Art. 77, margin no. 3). Nevertheless, the complaint must at least contain all the information necessary to enable the supervisory authority to ascertain the facts of the case and, if necessary, to clarify them further and to investigate any breaches of data protection law. The complaint must therefore contain information about the data subject and the person responsible, and must at least give some indication of the violation of data protection regulations that is being complained about (see Mundil, in: Wolff/Brink, BeckOK Datenschutzrecht, 31st Edition, as of 1 February 2020, Art. 77, para. 7). Finally, the complainant may not request an investigation into the matter by the LFDI. Although no legal analysis can be expected from the person concerned, the allegation of an infringement must be substantiated by facts. If the complaint is not yet sufficiently substantiated, it is the task of the supervisory authority to draw the complainant's attention to this and to work towards a concretization of the complaint (see Nemitz, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, Art. 77, para. 8).
24
2) Applying the legal standard described above, there is no sufficiently substantiated, verifiable complaint by the plaintiff. In his complaint dated February 5, 2019, the plaintiff stated that he needed assistance in his request for information under Art. 15 DSGVO. He had requested information from various authorities and referred in this respect to his enclosed letters of inquiry to the respective authorities and the replies of the Social Court of Mainz, the Social Court of Rhineland-Palatinate, the State Chancellery and the General Prosecutor's Office in Koblenz. From his letter of complaint and also from further correspondence with the LFDI as well as from his presentation in the complaint proceedings, however, it is not clear whether and why he assumes data processing by the requested authorities at all (a)), whether all requested authorities have replied to him or which authorities have not replied (b)) and why the replies he has received and attached to his complaint are not sufficient (c)).
25
a) Unless the plaintiff declares that (and why) he/she assumes that the data processing is carried out by the responsible authority and this is not apparent from the circumstances, the LFDI is already partially unable to verify its jurisdiction.
26
Art. 55 para. 3 DPA stipulates that the supervisory authorities - in this case: the LFDI - are not competent to supervise the processing of personal data carried out by the courts in the course of their judicial activities (see in this respect also recital 20 of the DPA). This means that the LFDI has no supervisory powers over courts insofar as they carry out activities related to judicial decision-making (see Selmayr, in: Ehmann/Selmayr, 2nd ed. 2018, DS-GVO Art. 55 para. 12). This is intended to take account of the constitutionally required independence of the judiciary (see Schaar, "Datenschutz und Rechtspflege", DRiZ 2018, 166, beck-online). The administration of justice, on the other hand, is not excluded from the jurisdiction of the supervisory authorities. Thus, the processing of personal data of employees of the judicial administration, data processing in connection with the procurement of funds for the courts as well as in connection with judicial administration acts and administration of justice activities are subject to the supervision of the LFDI (see Selmayr, in: Ehmann/Selmayr, DS-GVO, 2nd ed. 2018, Art. 55, marginal no. 14). With regard to the courts (Social Court of Mainz, State Social Court of Rhineland-Palatinate) to which the plaintiff addressed a request for information, the LFDI was unable to examine whether the data processing concerned - about which the plaintiff requested information - related to the judicial activities of the courts or the court administration due to the lack of substantiated submissions by the plaintiff. In his letter dated 7 March 2019, the plaintiff states that the respective court administrations had taken a position on his inquiries. However, for the purposes of an examination by the LFDI, it is not important who answers the request for information, but who has processed the personal data.
27
Likewise, the LFDI was not able to examine and positively determine its jurisdiction with regard to the plaintiff's complaint regarding his request for information to the Petitions Committee of the Rhineland-Palatinate State Parliament. Pursuant to § 2 para. 3 LDSG, the state parliament, its committees, its members, the parliamentary groups as well as their administrations and their employees are not subject to the provisions of this law to the extent that they process personal data in the performance of parliamentary duties. In this respect, the State Parliament shall issue a data protection regulation taking into account its constitutional status, the DSGVO and the principles of the State Data Protection Act. Thus, insofar as the plaintiff's request for information concerns the processing of personal data which has been carried out in the course of parliamentary duties, the LFDI as supervisory authority is not competent. However, the LFDI could not even examine whether and to what extent the plaintiff's data processing in the area of parliamentary tasks was affected by his request for information, because insufficient information was provided.
28
In this context, it should be noted that the LFDI has pointed out its limited jurisdiction in its letters of 15 February 2019 and 1 April 2019 and has informed that a data protection violation is not substantiated in the plaintiff's letters and that it is therefore requested to substantiate the complaint. The plaintiff was made aware of his complaint, which could not be examined, and was given the opportunity to substantiate his complaint on two occasions.
29
b) It is still not apparent from the complaint whether the plaintiff has received a reply from all authorities to which he has addressed a request for information. In any case, he has only received a reply to his complaint from some of the authorities addressed (Social Court Mainz, State Chancellery Rhineland-Palatinate, State Social Court Rhineland-Palatinate, General Public Prosecutor's Office Koblenz). In the letter from the Social Court of Mainz, the plaintiff is only informed that the complaint has been forwarded to the court administration for processing, so that it is not apparent whether and in what way a substantive answer to the request for information was later provided and whether it meets the legal requirements. In the letter of the State Social Court of Rhineland-Palatinate dated January 18, 2019, reference is only made to a reply probably given by the State Social Court in a letter dated January 8, 2019. The plaintiff did not include this reply letter with his complaint, so that a possible violation of the right to information according to Art. 15 DSGVO cannot be verified. Whether there were replies from the Petitions Committee of the State Parliament, the Ministry of Justice and the Public Prosecutor's Office in Mainz is not apparent from the complaint. Nor does the plaintiff expressly complain about any missing replies.
30
c) In support of his complaint, the plaintiff argues that it is not possible to identify from the replies received (with the exception of the information provided by the General Prosecutor's Office in Koblenz) which documents he can have deleted. However, the right of information under Art. 15 (1) (e) DSGVO alone covers the fact that the person concerned must be informed of the existence of his or her right to have the personal data relating to him or her deleted in accordance with Art. 17 DSGVO - as the State Chancellery of Rhineland-Palatinate did in its letter of information (the only letter submitted by the plaintiff in addition to the reply from the General Public Prosecutor's Office in Koblenz) in a legally sufficient manner. A right to be informed which specific documents containing personal data exist and may have to be deleted pursuant to Art. 17 DSGVO cannot be derived from Art. 15 para. 1 DSGVO. Nor does it follow from his request for information ("I hereby exercise my right to information pursuant to Art. 15 DSGVO and request a reply within the time limit provided for by law") that the plaintiff wanted to obtain copies of the personal data that are the subject of the processing by the respective responsible party, for example pursuant to Art. 15 para. 3 DSGVO, nor that he requested the deletion of his personal data. In any case, it would have been reasonable to expect the plaintiff, within the scope of his obligations to cooperate, to specify his request for information to the authorities in the event of an inadequate response from his point of view and, for example, to expressly request a copy. Moreover, it is not apparent that a data subject requires knowledge of certain documents in order to exercise his or her right of deletion under Art. 17 DSGVO; rather, it should be sufficient to request the deletion of certain personal data held by the responsible party.
31
In addition, the plaintiff, based on his complaint, apparently demands that the LFDI conduct training with the various authorities. However, the plaintiff has no enforceable claim to this. Neither can he enforce a uniform application of the law in the complaint or complaint procedure, although it is unclear in this respect what he sees as an inconsistent application of the law on the basis of the various responses he has received from the authorities.
32
Regarding the allegedly incomplete and incorrectly led administrative acts reprimanded by the plaintiff it is not evident in which way the file is to be manipulated and this reproach could affect the procedure in dispute. In the adjustment of the date on the notice of 26 April 2019 (p. 77 of the administrative file), no illegal manipulation can be identified. It is obvious that the letter on p. 77 of the administrative act was the final draft of the ruling. This is made clear by the fact that the State Data Protection Commissioner Mr. L. signed only with his abbreviation and an internal order is noted on the back (p. 76 of the administrative file). In the letter, the date of the final drafting of the letter (Friday, April 26, 2019) was corrected by hand above the date originally noted (April 24, 2019). This procedure was also confirmed by the defendant's representative at the oral hearing on June 18, 2020 (see Minutes of the public hearing of the 1st Chamber on June 18, 2020). It is not possible to conclude from a date correction without further indications of file manipulation, especially since the exact date on which the decision was drafted is not important here. The administrative file is incomplete only in that it does not contain an additional copy of the original decision sent to the plaintiff beyond the final draft version. Although it would be desirable for the defendant to include a copy of the original notice in the administrative file, no infringement of rights can be derived for the plaintiff from the defendant's previous administrative practice, especially since the letter on p. 77 - except for the handwritten corrected date - is identical in content to the notice that the plaintiff demonstrably received (p. 1 (back) of the court file). Contrary to the opinion of the plaintiff the administrative file does not have to illustrate also not the internal decision-making of the authority coworkers in detail.
33
The plaintiff was also granted access to the files in accordance with § 100 VwGO. He appeared twice at the Administrative Court to inspect the file; he was offered further opportunities to inspect the file, which he did not take advantage of. In addition, although the plaintiff was refused permission to take photographs or make copies of the administrative file himself, he was offered the opportunity to have copies made by the administrative office at his expense. He did not make use of this possibility.
34
In all other respects the reference of the plaintiff to a decision of the Administrative Court Mainz of 5 April 2017 (- 3 K 569/16.MZ -) is incorrect, since it did not concern therein an inspection of court and administrative files according to § 100 VwGO, but the freedom from charges for the inspection of official information locally according to § 13 exp. 1 sentence 2 national information liberty law - LIFG -.
35
The decision on costs follows from § 154 VwGO.
36
The decision on the provisional enforceability of the judgment with regard to costs is based on § 167 VwGO in conjunction with §§ Sections 708 et seq. Code of Civil Procedure - ZPO -.
37
Order of the 1st Chamber of the Administrative Court of Mainz of 22 July 2020
38
The value of the subject matter of the dispute is set at 5.000,00 € (§ 52 Abs. 1 und 2 Gerichtskostengesetz - GKG -).
Translated with DeepL
