LG Münster I - ECLI:DE:LGMS:2023:0704.16O238.22.00
From GDPRhub
| LG München I - ECLI:DE:LGMS:2023:0704.16O238.22.00 | |
|---|---|
 | |
| Court: | LG München I (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR |
| Decided: | 04.07.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | ECLI:DE:LGMS:2023:0704.16O238.22.00 |
| European Case Law Identifier: | ECLI:DE:LGMS:2023:0704.16O238.22.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | LG München I (in German) |
| Initial Contributor: | n/a |
The Regional Court of Munich held that the rights of the data subject overrode the economic interests of a credit agency, and thus the agency was unable to rely on Article 6(1)(f) GDPR as a legal basis for processing. As a result, the Court ordered the controller to erase the data subject’s personal data under Article 17(1)(d) GDPR.
English Summary
Facts
The data subject had faced insolvency proceedings, which were announced on a publicly accessible database. This publication is legally retained and made publicly available for 6 months following insolvency proceedings under German law. A credit agency (the controller) had negatively registered the data subject using the information from the public database and transmitted the data subject’s negative registration to its contractual partners. As a result, the data subject was unable to apply for credit products.
After being rejected for various credit-related applications due to their negative registration, the data subject filed a suit against the credit agency in the Regional Court of Munich.
Holding
The Court held that the controller was in violation of Article 6(1) GDPR, as they lacked a legal basis for processing the data subject’s data.
The Court held that the controller was unable to rely on Article 6(1)(f) GDPR for processing, because the economic interests of the controller could not override those of the data subject. Moreover, the controller had retained the data subject’s insolvency information beyond the 6-month period provided for under domestic law.
The data subject’s interests and rights took precedence over those of the controller. The negative registration created an unwarranted detriment to the data subject’s economic life. The Court concluded that the controller’s processing significantly interfered with the data subject’s constitutional right to self-determination under Article 1,2 of German Basic Law, the right to data protection under Article 8 of the European Charter of Fundamental Rights, and the data subject’s general freedom of action, freedom of contract, and the freedom to exercise a profession. Consequently, the controller was unable to rely on Article 6(1)(f) GDPR as a legal basis to processing.
As a result, the Court ordered the controller to erase the data subject’s personal data under Article 17(1)(d) GDPR, and ordered the controller to pay the data subject €579.17 in damages under Article 82(1) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
1T a t b e s t a n d 2The parties are in dispute over the deletion of the plaintiff's personal data from the defendant's credit agency. 3The plaintiff applied for the opening of insolvency proceedings in 00.00.0000. The Münster District Court canceled the insolvency proceedings (AG Münster, AZ ... IN .../19) with a decision dated 00.00.0000 after the confirmation of the insolvency plan became legally binding on 00.00.0000. A discharge of residual debt for the plaintiff did not provide for the cancellation of the insolvency proceedings. 4The defendant operates a credit reporting agency that collects and stores information from publicly accessible sources. It passes this data on to contractual partners in order to support them in assessing the solvency of potential customers and thus protect against potential losses. In this context, the defendant also saved the plaintiff's personal characteristics at issue, the latest status of his insolvency proceedings and the claims history of the plaintiff's three dunning proceedings. With regard to the details of the stored data, reference is made to the defendant's information dated 00.00.0000 (Appendix K2, page 23 ff. of the file). 5The plaintiff requested the defendant for the first time in a letter from his legal representative dated 00.00.0000 to delete the personal data mentioned in the form of the negative entries. The defendant refused to delete this data in a letter dated 00.00.0000. In a letter dated 00.00.0000, the plaintiff's legal representative again asked the defendant to delete the negative entries in dispute. The defendant repeatedly refused to delete the disputed negative entries in a letter dated 00.00.0000. 6The plaintiff claims that he has no opportunity to obtain a loan due to the negative entries in the defendant's credit agency. Also the conclusion He is not entitled to a new cell phone contract or other contracts with advance payment 8 possible. In addition, he could not conclude a contract to receive a credit card and it was not possible for him to purchase on account. These circumstances led to him being perceived as dubious despite his good net income in commercial transactions. He believes that the defendant is not entitled to continue storing his data, since a legitimate interest in processing the data about the insolvency only exists for as long as the regulation of Section 3 InsBekV provides for this, i.e. for six months. Beyond the lack of a legitimate interest on the part of the defendant, the processing of data relating to the plaintiff's insolvency is no longer necessary. In addition to the deletion of the data, a cease and desist order could also be demanded, as unlawful storage as a first offense indicates the risk of repetition. 9The plaintiff requests 10111. order the defendant to use the entries in its database about the plaintiff with the following wording: 12Public negative features 13Negative feature Corporate insolvency proceedings 14District Court N01 … 15File number .. IN …/19 16Procedural step Application to open insolvency proceedings, 00.00.0000 17Procedural step Opening of insolvency proceedings, 00.00.0000 18Procedural step Cancellation of the insolvency proceedings after confirmation of the insolvency plan, 00.00.0000 19to bring to extinction, 20212. order the defendant to publish the negative entry about the plaintiff contained in its database with the following wording: 22b) 23Type of procedure Ongoing commercial. Dunning procedure 24Amount of the main claim EUR 6,464.54 25Credit reform file number N02 26Date of default 00.00.0000 27Receipt date 00.00.0000 28Responsible Creditreform H. 29b) 30Type of procedure Completed commercial. Dunning procedure 31Amount of the main claim EUR 2,022.37 32Credit reform file number N04 33Date of default 00.00.0000 34Completion Date 00.00.0000 35Responsible Creditreform R. 36c) 37Type of procedure Completed commercial. Dunning procedure 38Amount of the main claim EUR 5,659.81 39Creditreform file number N05 40Date of default 00.00.0000 41Completion Date 00.00.0000 42Responsible Creditreform … 43to bring to deletion, 44453. to sentence the defendant, if he avoids an administrative fine of at least 5.00 euros or a maximum of 250,000.00 euros to be determined for each case of violation or, in the event that this cannot be collected, to a regular detention or administrative detention of up to 6 months, to be enforced against one of the members of the management, to refrain from processing the entries mentioned in the application under 1 and 2 again, 46474. to order the defendant to pay to the plaintiff the remaining balance of the business fee incurred in accordance with Sections 13, 14 No. 2300 VV RVG in the amount of 579.17 euros plus five percentage points above the base interest rate since the litigation was pending. 48The defendant requests 49to dismiss the lawsuit. 50The defendant is of the opinion that, for the proper assessment of the plaintiff's creditworthiness for its customers, it is important that the plaintiff was insolvent until the insolvency proceedings were lifted and was therefore essentially assetless and economically unreliable. The deletion of the negative entries within a period of three years after the insolvency proceedings were lifted would lead to an increased risk for the plaintiff's potential business partners. In addition, the defendant believes that entering the plaintiff's data only represents a low-intensity interference with his interests because the data is only accessible to a limited group of people. As a result, the storage in your credit agency is not comparable to the publicly available database www.insolvenzknownmachen.de, which is accessible to everyone and in which the deletion takes place in accordance with Section 3 InsBekV after 6 months after the insolvency proceedings have been lifted. In addition, storage for 3 years in your database is also necessary, as there is a significant risk of renewed default due to the initial lack of assets. Furthermore, the defendant believes that the plaintiff's claim under 2. a) is vague. 51Because of the details of the facts and the status of the dispute, reference is made to the contents of the written pleadings exchanged between the parties, as well as the appendices. 52E n t e d i d e r e a n g e s 53The lawsuit is completely successful. 54I.The lawsuit is admissible.1. 55The local jurisdiction of the court results from Section 44 Paragraph 1 Sentence 2 BDSG. The subject matter jurisdiction of the court results from Section 1 ZPO, Sections 23, 71 GVG due to the amount in dispute of EUR 15,000. The decision on the amount in dispute according to Section 48 GKG, Section 3 ZPO is based on the free discretion of the court. Based on comparable decisions (including LG Neuruppin, decision of October 4th, 2021 - 2 O 157/22; LG Aschaffenburg, judgment of October 7th, 2020 - 15 O 45/20) and as a result of the effects of negative entries at credit agencies with regard to the If the person concerned participates in legal and commercial transactions, an amount in dispute of EUR 15,000 is appropriate. 562. The lawsuit under 2.a) should be interpreted in appropriate application of §§ 133, 157 BGB to the effect that the plaintiff requests the deletion of the negative entry with the content as it is actually recorded and formulated in the credit agency. The wording of the application submitted differs from the actual entry in the credit agency, which no longer describes the procedure as an ongoing commercial one under the internal file number of Creditreform N02. Dunning procedure, but as a completed commercial transaction. Lists dunning procedures (page 25 of the file). However, contrary to the defendant's submission, it can be seen that the plaintiff wants to have the negative entry mentioned under this internal file number removed from the credit agency. In the end, it is irrelevant whether this dunning procedure is still ongoing or has already been completed, since the plaintiff is in any case seeking to have the negative entry removed under the internal file number of Creditreform N02. 57II.The lawsuit is well founded. 581.The plaintiff has a claim against the defendant for the deletion of the public negative information registered by the defendant with regard to the insolvency proceedings annulled by the Münster district court from the ref Negative entries regarding the three completed commercial transactions. Dunning procedure (point 2 of the operative part) from Article 17 Paragraph 1 Letter d GDPR, as the data processing by the defendant was not carried out lawfully. Storage of publicly obtained data in the course of insolvency announcements is not permitted beyond the expiry of the six-month deletion period of Section 3 InsBekV. 59The scope of application of the GDPR has been opened. The plaintiff's personal data, i.e. information that relates to an identified or identifiable person in accordance with Art. 4 No. 1 GDPR, is processed and stored here by the defendant as the person responsible in accordance with Art. 4 No. 7 GDPR. According to Art. 4 No. 2 GDPR, processing means any process or series of processes carried out with or without the help of automated processes in connection with personal data. The defendant stores data from the plaintiff about his insolvency proceedings and the latest status of the proceedings. In addition, it saves commercial dunning procedures that have been completed with the insolvency proceedings. The defendant transmits this stored personal data to its respective contractual partners, who in turn want to assess the plaintiff's ability to participate in legal transactions. 60However, the processing of the plaintiff's personal data at issue by the defendant is no longer lawful within the meaning of Art. 6 GDPR six months after the insolvency proceedings have been lifted. In principle, the processing of the plaintiff's personal data by the defendant is only lawful according to Art. 6 GDPR if there is a legal basis for the respective data processing or if the plaintiff has consented to the processing of his data. In the absence of the plaintiff's consent to the processing of his data Accordingly, the defendant can only consider lawful processing by the defendant based on legal bases. However, the court is convinced that there are no legal bases that justify the processing of the plaintiff's personal data at issue by the defendant. In particular, the requirements of Art. 6 Paragraph 1 Sentence 1 Letter e GDPR and the requirements of Article 6 Paragraph 1 Sentence 1 Letter f GDPR do not apply in favor of the defendant. 61 There is no lawful data processing by the defendant in accordance with Art or in the exercise of official authority vested in the person responsible. There is no dispute that there is any evidence that the personal data is processed in the exercise of official authority. However, the processing is also not necessary to carry out a task that is in the public interest. The permission for data processing in accordance with Art. 6 Paragraph 1 Sentence 1 Letter e GDPR serves state information services such as the portal “www.insolvenzgewinnmachen.de”. However, this does not mean that permission for data processing for private credit agencies, as is also operated by the defendant, can be derived (Kühling/Buchner, DS-GVO BDSG, 3rd edition 2020, Art. 6, Rn. 132; Munich Higher Regional Court, judgment of October 24, 2022 – 3 U 2040/22, Rn. 20). 62Similarly, the data processing carried out by the defendant does not constitute lawful data processing within the meaning of Art various interests clearly predominate. 63The defendant initially has an economic interest in processing the plaintiff's personal data. This economic interest is promoted by offering a database that is as comprehensive and complete as possible with as much credit-relevant data as possible on possible debtors. The data processing also serves to make the information available to the defendant's customers in advance of contract negotiations or upon conclusion of contracts, so that they can assess whether the contractual partners may have payment difficulties. The processing of the information therefore has economic value for the defendant (cf. OLG Oldenburg, judgment of November 23, 2021 - 13 U 63/21, Rn. 30; cf. OLG Schleswig, judgment of June 3, 2022 - 17 U 5/22 , Rn. 60). As a result, this serves the defendant to be able to differentiate itself from other credit reporting agencies in its offering and to strengthen its own market position (see OLG Schleswig, judgment of June 3, 2022 - 17 U 5/22, Rn. 61).There are also interests of third parties that need to be taken into account. These are not excluded from the outset due to a lack of specific designation by the defendant. Even an abstract interest in information and the general need to obtain information in credit transactions form a typical situation that regularly occurs in the case of credit granting. Even without a potential future contractual partner having already been named and the content of a specific contract to be concluded already being sufficiently known or there already being concrete data queries from potential contractual partners of the plaintiff, these potential contractual partners have a legitimate interest in the plaintiff's economic situation and thus in The storage of this in the defendant's credit agency and the provision of the resulting information can already be sufficiently established (cf. OLG Oldenburg, judgment of November 23, 2021 - 13 U 63/21, Rn. 27 ff.). This serves to balance the existing Information disparity between potential lenders and borrowers with regard to the economic performance of the potential borrower. Otherwise, lenders would be solely dependent on the information provided by their potential borrowers and would therefore be exposed to considerable risks of deception and other uncertainties in business transactions. The processing of the data by the defendant essentially serves to enable lenders to make an accurate and objective assessment of the creditworthiness of a potential contractual partner and thus to secure legal and credit transactions in Germany as a whole, especially since lenders are obliged to comply with the relevant legal provisions to provide a viable picture of the resilience of their respective contractual partners (particularly in the consumer sector) (OLG Cologne, judgment of January 27, 2022 - 15 U 153/21, Rn. 38). 64These interests of the defendant and third parties are, however, offset by a significant interest of the plaintiff. The continued inclusion of the note about the cancellation of the insolvency proceedings against the plaintiff affects his significant interests and fundamental rights. The data processing not only significantly affects the fundamental right to informational self-determination under Articles 1, 2 of the Basic Law and Article 8 of the European Charter of Fundamental Rights Union itself, but also in the fundamental right to general freedom of action, general freedom of contract and freedom to practice a profession (OLG Schleswig, judgment of June 3, 2022 - 17 U 5/22, Rn. 62). According to the information provided to the plaintiff by the defendant the plaintiff's score cannot be calculated due to negative payment experiences. It is obvious that making this information available to the plaintiff's potential contractual partners has a significant influence on the plaintiff's participation in general economic life. Accordingly, due to this situation, there is no need for the plaintiff to specifically state whether and which contractual agreements failed in detail. In this context, it should also be taken into account that the defendant did not specifically name the interests of third parties actually affected, but the general interests of potential third parties are nevertheless taken into account when weighing up the matter. Due to this score and the continuous registration of the cancellation of the plaintiff's insolvency proceedings, the plaintiff is hindered from participating in economic life. The processing of the plaintiff's data beyond the six-month period specified in Section 3 InsBekV will make it massively more difficult for him to be able to carry out legal transactions such as the conclusion of rental agreements, cell phone contracts and loan agreements for another two and a half years after the insolvency proceedings have been lifted. In addition, taking out loans and concluding contracts that require the provision of a credit report are made significantly more difficult for the plaintiff or are only possible under comparatively worse conditions, which in turn have a negative impact on the plaintiff's financial situation. The storage of the disputed negative entries and their transmission by the defendant to its contractual partner ultimately results in the plaintiff being subject to serious financial disadvantages, even though the insolvency proceedings originally against him have been overturned a long time ago. It should also be noted that that it is generally known that large circles of commercial companies obtain information from credit reporting agencies before concluding a contract. This applies to banks, energy companies and telecommunications companies, among others. The notification that the plaintiff has gone through insolvency proceedings makes it more difficult for the plaintiff to participate in legal transactions and thus counteracts the aim pursued by the legislature with the introduction of private insolvency of enabling the debtor to make a fresh start after successfully completing the insolvency proceedings (OLG Munich, judgment of October 24th .2022 - 3 U 2040/22, Rn. 26). The court is convinced that the deletion period from Section 3 InsBekV should be taken into account as a normative point of reference for weighing up the conflicting interests (cf. Munich Higher Regional Court, judgment of October 24, 2022 – 3 U 2040/22, Rn. 25) Accordingly, the question arises as to whether § 3 InsBekV is directly or analogously applicable with regard to private credit agencies and therefore the defendant has no interest after the expiry of the six-month period for deletion or third parties are involved in the processing of the insolvency cancellation data. With regard to Section 3 InsBekV, it can be assumed that the legislator has adequately considered the extent to which a public announcement interferes with the rights of insolvency debtors and the extent to which the legitimate information interests of the general public justify such an intervention. The result of this consideration by the legislator was obviously that a publication period of six months after the cancellation of the insolvency proceedings is sufficient and appropriate (OLG Schleswig, judgment of June 3, 2022 - 17 U 5/22, Rn. 70). It should also be taken into account that the defendant copied the data in dispute from an official publication on the Internet. She is therefore creating a parallel database - on a large scale. Whether such private parallel databases are even permissible under European law within the framework of the GDPR was questioned by the VG Wiesbaden as part of its ECJ submission (decision of January 31, 2022, 6 K 1052/21), but can remain open in the present case. Assuming the admissibility of parallel databases, such derivative databases must adhere to the rules applicable to the original data in accordance with the spirit and purpose of data protection law. It appears incompatible with the fundamental protective principles of data protection law if statutory deletion deadlines are circumvented by copying data and storing it elsewhere (OLG Munich, judgment of October 24, 2022 - 3 U 2040/22, Rn. 25). The legislature has also recognized the possible problems with creating such parallel databases. For this reason, when the legislature introduced the provision of Section 3 Paragraph 2 InsBekV, it asked the Federal Ministry of Justice at the time to ensure by means of a legal ordinance that “the publications… cannot be copied by third parties based on the state of the art.” (BT-Drs . 14/6468). However, the introduction of such copy protection failed due to technical problems. According to a statement from the federal government at the time, the copying of Internet publications could not be prevented (BT-Drs. 16/960). Furthermore, it must be taken into account that the defendant's submission relates almost exclusively to insolvency proceedings that are carried out in accordance with Sections 286 InsO ff. be concluded with a discharge of residual debt. However, the lawsuit relates to the deletion of negative entries regarding insolvency proceedings, which were canceled without discharge of residual debts. The defendant does not provide any substantiated argument as to why the statement regarding the discharge of residual debts also applies to the cancellation of the insolvency proceedings without discharge of residual debts. Rather, the cancellation of the insolvency proceedings without discharge of residual debts suggests a positive development of the plaintiff's assets, so that the plaintiff has an even greater interest in the deletion of the negative entries compared to an insolvency debtor who has completed insolvency proceedings with discharge of residual debts. At the same time, he is also more in need of protection because he poses a comparatively lower risk to general legal transactions. The arguments developed by the cited case law of the Higher Regional Court of Schleswig and the Higher Regional Court of Munich, which the Chamber agrees with, must therefore apply “a fortiori” to those affected whose insolvency proceedings - as with the plaintiff in the present proceedings - ended in annulment. 652.The plaintiff also has a claim against the defendant to refrain from storing and transmitting the disputed personal data again in corresponding application of Sections 1004 Paragraph 1 Sentence 2, 823 Paragraph 2 BGB in conjunction with Article 17 Paragraph 1 GDPR. There is a risk of repetition by the defendant as a credit reporting agency. An impairment of the plaintiff by the defendant, as in this case, justifies the assumption of a risk of repetition (see OLG Schleswig, judgment of July 2, 2021 - 17 U 15/21, Rn. 80; Gola/Heckmann/Nolte/Werkmeister, 3 . Edition, GDPR Art. 17 Rn. 73). 663.The plaintiff has a claim against the defendant for reimbursement of the pre-trial legal fees claimed by him in the amount of EUR 579.17 under Article 82 (1) GDPR, § 249 BGB and §§ 280 (1), 286 (1). , 249 BGB. 67III.The cost decision is based on Section 91 Paragraph 1 ZPO. 68The decision on provisional enforceability follows from § 709 ZPO and corresponds to the amount of the effort of the defendant here estimated by the chamber, which is associated with the titular deletion obligation (BeckOK ZPO/Ulrici, 48th ed. March 1, 2023, ZPO § 709 para . 5.4). 69To the extent that a necessary enforceability decision was not made with regard to tenor 4 and tenor 5, this is due to an oversight. 70IV. 71The court refrained from a further suspension in accordance with Section 148 ZPO with regard to the preliminary ruling procedure pending before the ECJ by the VG Wiesbaden (decision of January 31, 2022 - 6 K 1052/21) in order to ensure effective legal protection for the plaintiff.
