OLG Schleswig - 17 U 15/21
| OLG Schleswig-Holstein - 17 U 15/21 | |
|---|---|
 | |
| Court: | OLG Schleswig-Holstein (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(e) GDPR Article 6(1)(f) GDPR Article 17(1)(d) GDPR Article 40(5) GDPR § 28 BDSG a.F. § 29 BDSG a.F. § 35 BDSG a.F. § 3 InsoBekV |
| Decided: | 02.07.2021 |
| Published: | |
| Parties: | Schufa Holding AG |
| National Case Number/Name: | 17 U 15/21 |
| European Case Law Identifier: | ECLI:DE:OLGSH:2021:0702.17U15.21.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Landesvorschriften und Landesrechtsprechung Schleswig-Holstein (in German) |
| Initial Contributor: | n/a |
The court ruled that under current German law, insolvency data may be processed by credit rating agencies only for as long as this data is stored in the national insolvency notice portal (i.e. 6 months after the insolvency proceedings have been cancelled or its discontinuation is unappealable). Furthermore, the court stated that processing can only be based on third party interests if the respective third party has already been concretely identified.
English Summary
Facts
The controller is the Schufa Holding AG, a German credit scoring agency.
The data subject went into private insolvency after a failed business start-up. The insolvency proceedings were concluded and he was discharged from residual debt. This was published - as provided for under national law - on the online insolvency notice portal (www.insolvenzbekanntmachungen.de). § 3(1) of the German Insolvency Notification Regulation (InsoBekV) provides that such publications must be deleted no later than six months after the discontinuation of the insolvency proceedings has become unappealable. The respective entry on the data subject was deleted during this period.
The controller included the information on the discharge of residual debt in its database at the time of its publication on www.insolvenzbekanntmachungen.de. However, it continued to store the information in its database after it was deleted from the aforementioned register and processed it for credit assessment purposes.
The controller is a member of an association of German credit agencies. This association has given itself rules of conduct according to which the information about the discharge of residual debt is to be deleted after 3 years. The data subject received (after deletion on www.insolvenzbekanntmachungen.de) a rejection for a flat enquiry because of his bad credit rating.
An action by the data subject for deletion of the entry on residual debt discharge was dismissed at first instance. The data subject appealed against this decision to the Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein).
Dispute
Holding
The court ruled that the data subject was entitled to erasure under Article 17(1)(d) GDPR, as the data processing was not lawful. In any case, the requirements of Article 6 GDPR were no longer met 6 months after the discharge of residual debt had become unappealable.
Article 6(1)(e) GDPR
The court first states that the processing cannot be based on Article 6(1)(e) GDPR. For this to be the case, the processing must be necessary for the performance of a task carried out in the public interest. In the court's opinion, the controllers' business purpose generally is in the general public interest. The protection against the granting of loans to those unable and unwilling to pay is a legitimate interest of the public. In addition, the controller's clients have an interest in receiving as much economically relevant data about their clients as possible.
However, there was no public interest in the specific data of the discharge of residual debt. It is not apparent why the specific data would be necessary for the controller to be able to perform its task in economic life. The controller could continue to process all data that it had collected with the consent of the data subject. A different view would lead to any processing of commercially relevant information being lawful under Art. 6 (1)(e) GDPR.
Moreover, the mandatory requirement of Article 6(3)(1)(b) GDPR, according to which a separate legal basis for the processing is necessary, is not met. Such basis existed in the old German Data Protection Act (BDSG a.F.). However, it ceased to apply with the introduction of the GDPR and the new German Data Protection Act (BDSG n.F.). The potential legal basis of § 3 InsoBekV is not sufficient in this case because the deletion period has already expired.
Article (6)(1)(f) GDPR
The court further ruled that the processing could not be based on Article 6(1)(f) GDPR in any case 6 months after the discharge of residual debt had become unappealable.
Interests of the controller
The court found that the controller had no legitimate interest of its own in the processing.
Interest of the credit rating in principle worthy of recognition
Its business purpose provides for the processing of economically relevant data for a credit rating and the corresponding information to its customers. In principle, this business purpose was also worthy of recognition, since there was a public interest in protecting lenders from giving loans to those who were unwilling or unable to pay. This was in line with the established case law of the Federal Supreme Court (BGH).
On the other hand, the court also states that an insolvent debtor has usually previously fed the third-party funds into the economic cycle, e.g. in the case of a business start-up. A successful social market economy is based on the fact that business start-ups also fail economically.
The discharge of residual debt is an economically relevant data. A lender estimates the creditworthiness of a previously insolvent debtor to be worse, without a statistical connection between former insolvency and later payment defaults being relevant.
Interest regarding insolvency data de lege lata not legtimate
The court then found that the controller's interest was not legitmate because it contradicts to § 3 InsoBekV. There can be no such contradiction only if the deletion period provided for in the regulation is complied with. According to the meaning and purpose of this provision, the debtor should have a new start after a period of good conduct and the discharge of residual debt. This is not to be complicated by further disclosure of the earlier insolvency. According to the legislator's intention, insolvency data should therefore only be published in the insolvency notice portal. Exceptions are only envisaged under Land law, for example for regional reasons. Publication beyond this is not to be permitted.
Assessment de lege abrogata not relevant
This assessment was also not contradicted by the fact that storage was deemed permissible de lege abrogata. The old view was based on §§ 28, 29, 35 BDSG a.F., which no longer apply today.
The assessment cannot be transferred to the current legal situation either. The national legislator deliberately omitted to incorporate the aforementioned provisions into the new BDSG. It has not made use of the possibility under Article 23(1)(i) and (j) GDPR to extend storage periods for credit agencies by means of a statutory regulation. This was once envisaged in a draft amendment to the German Insolvency Code (InsO), but was not adopted.
Third-party interests
The court also ruled that the processing could not be based on third-party interests. After all, in this case - before the potential landlord's enquiry - no enquiries had been made by third parties. However, the third party must already be known in order for a balancing of interests under Article 6(1)(f) GDPR to be possible. Mere general interests are not sufficient. Even the mere abstract possibility that an interested party might be found in the future is not sufficient de lege lata because of § 3 InsoBekV. It is not possible to store data without a reason. Schufa was not a "collaborative institution for the lending industry".
Deletion deadlines in self-imposed rules of conduct are not sufficient
Ultimately, the court's decision was not contradicted by the fact that the rules of conduct of the association of German credit reporting agencies provide for a deletion period of 3 years. This constitutes an irrelevant "self-commitment".
This is not changed by the fact that the German DPA in North Rhine-Westphalia (LfDA NRW) has approved the rules of conduct according to Article 40(5) GDPR. It could not be deduced from this that every processing in the sense of the rules of conduct would be lawful. Otherwise, the imposition of a fine in case of compliance with approved rules of conduct would be difficult to justify.
Ultimately, the conduct rule was in contradiction with § 3 InsoBekV (and § 9 InsO).
The appeal was allowed.
Comment
The decision differs from other decisions, especially from Austria, in which the processing of insolvency data after deletion from insolvency registers is considered permissible for more than five years (https://gdprhub.eu/index.php?title=BVwG_-_W214_2228164-1/13E). However, the German court justifies its decision mainly with the lack of a corresponding national legal basis, which exists in Austria with § 152 of the Austrian Commercial Code (GewO 1992). The recourse to the admissibility under the old law and to Article 21(1)(i) and (j) GDPR shows that the court assumes that a processing of insolvency data that goes beyond § 3 InsoBekV may be possible in principle, provided that the legislator takes action. Should this happen (there have already been corresponding drafts, as the court also points out), the judicial situation could be adapted to the Austrian situation, whereby the period of 5 years provided for there under court law, based on the Capital Requirements Regulation, appears highly questionable and, against the background of § 3 InsoBekV, will probably not find its way into German decisions.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
