AG Pankow - 4 C 199/21
From GDPRhub
| AG Pankow - 4 C 199/21 | |
|---|---|
 | |
| Court: | AG Pankow (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 18(1)(c) GDPR |
| Decided: | 28.03.2022 |
| Published: | |
| Parties: | anonymous S-Bahn Berlin GmbH |
| National Case Number/Name: | 4 C 199/21 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Rewis (in German) |
| Initial Contributor: | n/a |
The District Court of Pankow held that a controller can refuse to answer a request of access under Article 15 GDPR if the effort required to comply with the request is grossly disproportionate to the data subjec's interest to access.
English Summary
Facts
The controller is a railway company. It has video cameras installed in some of its trains which are active during the operation of the trains. The recordings are automatically deleted after 48 hours.
The data subject boarded one of these trains on the 27th of April 2021. By email of the same day the data subject requested the controller to hand over the video footage and not delete it. The controller, however, deleted the data within the deletion period of 48 hours and, therefore, refused to provide the requested information to the plaintiff in a letter dated 3rd of May 2021.
As a consequence, the data subject filed a lawsuit with the District Court of Pankow (Amtsgericht Pankow - AG Pankow) requesting damages in the amount of €350 according to Article 82 GDPR.
Holding
The District Court rejected the claim of the data subject. It held that the controller did neither violate Article 15(1) GDPR nor Article 18(1)(c).
It found that the controller 's refusal to answer the request of access was legitimate according to § 275(2) BGB (German Civil Code). Under § 275(2) BGB a debtor can refuse performance insofar as this requires an effort which, taking into account the legal relationship of the parties and the requirements of good faith, is grossly disproportionate to the creditor's interest in performance. The court concluded that, since the data subject was already aware of the processing, its circumstances and its content, the purpose of Article 15 GDPR was already largely fulfilled. Furthermore the court reasoned that, because of the short retention period of 48 hours, a loss of control of the data subject over his personal data was not apparent. On the other hand, the court found that preventing the automatic deletion and filtering out the recording of the data subject would have taken a considerable amount of time, costs and manpower for the controller, especially since the controller did not have a facial recognition software.
The court also found no violation of Article 18(1)(c) GDPR by taking the above circumstances into account. It reasoned that Article 18(1)(c) GDPR also requires a balancing of the interests of the parties, whereas especially the likelihood of litigation, the weight of the claims involved and the interests of the data subject, must be taken into account.
Comment
The Pankow District Court stands in flagrant opposition to Guidelines 3/2019 on processing of personal data through video devices and the proposed Guidelines 1/2022 on data subject rights - Right of access of the EDPB:
According to the court's findings,
- the controller did not take any measures to answer the data subject's request for access. And “demonstrate the manifestly unfounded or excessive character of the request” (in opposition to Guidelines 3/2019; para. 98) only by the fact that they had not taken any measures to be able to answer the request at all.
- the controller may assess the “why” of a request (in opposition to Proposed Guidelines 1/2022; para. 13) and refuse if the “why” is not making sure about “existence, purposes, intentions and legal consequences” of the processing.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Tenor ----- 1. The application is dismissed. 2. The plaintiff is ordered to pay the costs of the proceedings. 3. The judgment is provisionally enforceable. The plaintiff may prevent the defendant's enforcement by providing security in the amount of 110% of the amount enforceable on the basis of the judgment, unless the defendant provides security in the amount of 110% of the amount to be enforced before enforcement. 4. 4. The appeal is allowed. 5. The amount in dispute is set at €350.00. Facts ----- The plaintiff seeks compensation for pain and suffering from the defendant. The defendant is a passenger transport company. In some of the defendant's trains, video recording of the train interiors takes place when the train is in operation. The recordings are stored for 48 hours. By e-mail of 27 April 2021, the plaintiff informed the defendant that he had boarded the S-Bahn, train no. 482 479, at Schönhauser Allee station at around 2:18 pm. He asked the defendant to hand over the video information concerning him and at the same time requested the defendant not to delete the data concerning him. The defendant deleted the data within the deletion period of 48 hours and refused to provide the requested information to the plaintiff in a letter dated 3 May 2021. The plaintiff alleged that on 27 April 2021 at 2.18 p.m. he boarded a train of the defendant at the Schönhauser Allee station in Berlin and was captured by an installed camera of the defendant. The plaintiff is of the opinion that there has been a violation of the Basic Data Protection Regulation, which leads to damages for pain and suffering in the amount claimed. The plaintiff - requested that the defendant be ordered to pay him damages for pain and suffering in the amount of €350 as well as interest in the amount of five percentage points above the base rate since the lis pendens. The defendant requested - that the action be dismissed. For the details of the facts and the dispute, reference is made to the pleadings exchanged between the parties, together with the annexes. The action was served on 6.10.2021. Reasons for decision -------------------- 1. The action is admissible. The territorial jurisdiction of the court seised results from Article 79(2) of the GDPR. 2. However, the action is unfounded and must be dismissed. 3. The plaintiff is not entitled to damages for pain and suffering against the defendant. In particular, he has no claim under Article 82(1) of the GDPR. According to this provision, a person may claim damages for harm caused because of an infringement of the regulation. 4. There is no infringement by the defendant. The defendant's refusal to provide the plaintiff with information about the requested data does not violate the plaintiff's right to information pursuant to Article 15(1) of the GDPR, nor does it violate the right of a data subject under Article 18(1)(c) of the GDPR to request the controller to refrain from deleting the data. 5. It can be left open whether the plaintiff travelled on the defendant's commuter train at the time he claimed. Even assuming this claim by the plaintiff to be true, the action cannot succeed. However, with regard to the claim for information based on this pursuant to Art. 15 GDPR, the fulfilment of this claim for information is unreasonable for the defendant due to disproportionate effort pursuant to § 275 para. 2 BGB (cf. Gola/Franck, DS-GVO, Kommentar, 1st ed. 2017, Art. 15, marginal no. 30). Due to the exceptional nature of Section 275 (2) of the German Civil Code (Bürgerliches Gesetzbuch, BGB) and due to the central importance of the right to information pursuant to Article 15 of the GDPR, strict standards must be applied to the disproportionate nature of a request for information. 6. However, such a gross disproportion exists here. This is because the plaintiff's interest in transparency is extremely low. In particular, he was aware of the whether, how and what of the data processing (cf. Gola/Franck, DS-GVO, Kommentar, 1st ed. 2017, Art. 15, marginal no. 2). The plaintiff knew exactly that and to what extent personal data would be collected. The normative purpose of Art. 15 GDPR -- becoming aware of the data processing -- was therefore already fulfilled to the greatest possible extent. The facts of the case here are precisely not comparable to a situation in which a person requesting information wants to obtain an overview of personal data that have been processed, possibly for a longer period in the past, or in which data are processed on different occasions; the data processing by the defendant is limited from the outset to 48 hours in terms of time and location to the defendant's trains. It is reasonable for the plaintiff and any other third party to remember within the short period of 48 hours when a service of the defendant was used and when accordingly a processing of personal data took place. In view of the very short period of time, the loss of control complained of by the plaintiff is not recognisable. As the plaintiff himself points out, he was also informed by the defendant about all aspects of the data processing covered by Art. 15(1)(a)-(h) GDPR, including the purpose of the processing, the duration of the processing and the right of appeal. In this respect, too, the normative purpose of Art. 15 GDPR of providing information on the “existence, purposes, intentions and legal consequences” of the data processing is fulfilled (cf. Paal/Pauly Basic Data Protection Regulation, Federal Data Protection Act, 3rd ed. 2021, Art. 15 para. 3). What further interest the plaintiff has in the concrete form of the video recording has not been sufficiently explained and is not apparent. For the review of the lawfulness of the video recording as an essential purpose of Art. 15 GDPR, the plaintiff does not need the concrete form of the video recording. Regardless of the concrete resolution of the video recording or the possible collection of biometric data, the intrusive nature of the recording is essentially certain. Accordingly, the plaintiff's interest in reassurance protected by Article 15 of the GDPR is small. 7. In contrast, the defendant has substantiated that the fulfilment of the right to information by preventing the automatic deletion and subsequent provision of information to the plaintiff involves a considerable effort in terms of time, costs and manpower. It is recognised under European law that such an effort can stand in the way of a request for information (see ECJ, judgment of 19.10.2016, C 582/14). On the one hand, the defendant does not have any software for facial recognition. Accordingly, it would be complex for the defendant to identify the plaintiff on the basis of his information. In this respect, the defendant has substantiated that considerable resources would be necessary to identify persons and that the removal of the cassettes in accordance with data protection requirements would be costly due to travel times to the trains and security precautions. Secondly, the information to the plaintiff would require the defendant to adapt its company agreement with regard to the evaluation of the memory cassettes and to evaluate them itself or to commission third parties to do so. However, adapting its processes, for example by purchasing software for automated facial recognition or by centrally storing the video recordings, would also involve a considerable effort and, in addition, meet with considerable data protection concerns. In this respect, the defendant has explained that its decentralised processing procedures precisely serve data protection. If it were obliged to store data for a longer period of time due to the plaintiff's request, the interests of third parties protected by Article 15(4) of the GDPR would necessarily be affected. Due to the defendant's obligation under data protection law towards third parties, this third party concern must also be taken into account in the context of the examination of the plaintiff's and defendant's interest in equivalence required under § 275 (2) BGB. For even if the pixelation or other obliteration of third parties is technically possible, this identification and obliteration cannot be reliably achieved within 48 hours, or in some cases within an even shorter period of time. Therefore, the data protection rights of third parties would necessarily be affected if data were stored for a longer period of time after a request for information. In this respect, the plaintiff fails to recognise that the information he seeks threatens to weaken the strict deletion periods of Section 20 (5) of the Federal Data Protection Act in conjunction with Article 17 of the GDPR vis-à-vis third parties and thus a central normative concern of data protection law. Due to this, the plaintiff's limited gain in knowledge of the concrete form of the video recording takes a back seat in view of the considerable expenditure of resources of the defendant as well as data protection rights of third parties, which is why a gross disproportion between the interest in performance and the expenditure is to be assumed pursuant to § 275 para. 2 BGB. 8. In this respect, it can be left open whether a right of refusal of the defendant also follows from an analogous application of Article 14 (5) of the GDPR. It can also be left open whether the longer storage of personal data and subsequent information about it requested by the plaintiff is already legally impossible due to a violation of § 20 para. 5 BlnDSG, § 275 para. 2 BGB. 9. For the same reasons, the defendant's failure to prevent automatic erasure does not violate Art. 18(1) GDPR. According to Article 18(1)(c) of the GDPR, a data subject may request the controller to prevent erasure if he or she needs the processed data for the establishment, exercise or defence of legal claims. However, even in the context of Art 18 GDPR, which provides for preventing erasure if the request is necessary, a balancing prognosis must be made in the individual case, taking into account the likelihood of litigation, the weight of the claims involved and the concerns of the data subject (cf. Auernhammer/Stollhoff, Basic Data Protection Regulation, Commentary, 6th edition' 2018, Art 18, para 21). As already explained, the plaintiff's interest in the video recording is low. To the same extent, the concerns regarding the defendant's burden under Art 18(1c) GDPR prevail. It can therefore also be irrelevant with regard to a claim under Art. 18(1) of the GDPR whether stopping the automatic deletion by the defendant was legally impossible from the outset due to § 20(5) of the BlnDSG. 10. Irrespective of this, the plaintiff is not entitled to damages for pain and suffering under Art. 82 GDPR even in the event of an alleged violation of the GDPR. The prerequisite is not only a violation, but also that the plaintiff has suffered damage. The mere fact that the plaintiff did not receive the information or the deletion was not prevented cannot constitute compensable damage. Even in the case of non-material damage, an impairment must have occurred, which must at least be perceptible, irrespective of a materiality threshold (cf. LG Bonn, judgment of 01.07.2021 - 15 O 355/20 - juris). Otherwise, damage is conceptually ruled out. However, the plaintiff did not allege such damage. 11. The decision on costs follows from section 91 (1) ZPO. 12. The decision on provisional enforceability is based on §§ 708 no. 11, 711 ZPO. 13. The appeal was to be allowed pursuant to § 511 para. 1 no. 1 ZPO.
