OLG Frankfurt am Main - 6 U 127/24
| OLG Frankfurt am Main - ECLI:DE:OLGHE:2024:1031.6U127.24.0A | |
|---|---|
 | |
| Court: | OLG Frankfurt am Main (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 18 GDPR |
| Decided: | 31.10.2024 |
| Published: | 12.11.2024 |
| Parties: | |
| National Case Number/Name: | ECLI:DE:OLGHE:2024:1031.6U127.24.0A |
| European Case Law Identifier: | |
| Appeal from: | LG Wiesbaden (Germany) 2 O 35/24 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | beck (in German) |
| Initial Contributor: | tjk |
The court found a the score lock lawful, since it based on Article Article 18 GDPR and does not distort or falsify information.
English Summary
Facts
The data subject in the injunction challenges the block imposed by the controller on the data subject in the injunction of the database for the provision of information on contractual partners with the application to lift the so-called "score block" and to refrain from a future block until the decision in the main action. The controller in the injunction is a joint institution of the German lending industry. It operates a database with information that is relevant for the assessment of credit ratings. Its contractual partners provide it with information relevant to the database from their business relationships with their customers. The controller stores this information as entries in its database in order to be able to provide its contractual partners with information. The parties are in dispute before the Regional Court of Münster about the legality of the so-called score value, which the controller determines on the basis of the data available to it and which is intended to assess the creditworthiness of the person concerned. With regard to this procedure, the controller imposed a so-called score block until its conclusion, with the consequence that no more credit score values are transmitted in the event of a corresponding query by the controller's contractual partners. In a letter dated February 22, 2024 (Exhibit Ast3), the controller refused to lift the block before the end of the legal dispute before the Regional Court of Münster. The Regional Court dismissed the application for a preliminary injunction by judgment of April 5, 2024, to which reference is made in accordance with Section 540 I ZPO with regard to the factual findings. In its reasoning, it stated that the request of the data subject for the injunction already violated Section 242 BGB in the form of contradictory conduct (venire contra factum proprium). With his motions in the present preliminary injunction proceedings, he is contradicting his factual submission and his motions in the proceedings before the Regional Court of Münster. There, the application was for an injunction against the disclosure of score values, whereas here the application is for disclosure. Furthermore, the data subject in the injunction is not entitled to any contractual claims due to the lack of a contract. There is also no claim arising from a management without mandate in the form of a third-party transaction. The controller in the injunction exclusively conducts a transaction in its own interest with its contractual partners, even if this may have a reflex effect on the data subject's legal sphere and interests, in that the notification of the score assessment may be helpful or obstructive for the conclusion of contracts by the data subject in the injunction. The data subject could not assert any claims for injunctive relief under the GDPR either. The GDPR does not provide for a claim to a processing activity by the controller against its express will. A claim under Section 823 I, 1004 BGB ultimately fails in any case because the score block not unlawful. Since the data subject in the injunction had objected to the data processing in its previous form (in the proceedings before the Regional Court of Münster), the controller in the injunction had restricted the data processing. Article 18 GDPR provides for such a restriction of data processing, which is why this cannot be unlawful. There was no distorting or falsifying presentation of the score value. In any case, there was an objective reason not providing the score information. The controller in the injunction is initially guided the requirements Article 18 GDPR. In addition, with regard to the proceedings before the Münster Regional Court, the consequences would ultimately not be foreseeable for the controller in the injunction if it were to further information. Furthermore, the requirements for a performance order were not met. 6 The data subject's appeal is directed against this. 7The data subject in the injunction applies, to decide as follows, amending the judgment of the Regional Court: I. The controller is ordered to immediately and until the decision in the main action to lift the block imposed on the applicant of the database for the provision of information on contractual partners, the so-called "score block"; II. The controller is ordered to pay a fine of up € 250,000.00 for each case of infringement or, in the event that this cannot collected, to pay a fine of up to six months' imprisonment. months, to be enforced against one of the members of the controller's Management Board, to impose a new block on the applicant's database for the purpose of providing information on contractual partners, a so-called "score block", or to inform third parties that a "score block" has been set up for the applicant, until a decision has been reached in the main proceedings. The controller in the injunction proceedings requests that the appeal be dismissed.
Holding
The admissible appeal is unsuccessful on the merits. Neither a claim for an injunction nor a reason for an injunction has been substantiated, so that it is irrelevant whether the data subject's conduct is compatible with Section 242 BGB. 1 The data subject in the injunction was unable to the existence of a claim for an injunction. A basis for a claim is not recognizable. a) Since a contractual relationship exists exclusively between the controller and its contractual partners, but not with the data subject, the data subject is not entitled to contractual claims (see OLG Munich, judgment of March 12, 2014 - 15 U 2395/13, ZD 2014, 570). 12In particular, the controller in the injunction has neither refused to conclude a contract with the data subject in the injunction, nor is the latter seeking to enforce a contract with the controller in the injunction. In this respect, the monopoly position of the controller alleged by the data subject and the resulting obligation to contract in his opinion are irrelevant for the decision to be made here. b) The data subject in the injunction does not have a claim based on culpa in contrahendo pursuant to Sections 311, 241 BGB. 14 A contractual obligation with duties pursuant to Section 241 (2) BGB has not arisen between the parties. 15 Pursuant to Section 311 (3) BGB, this presupposes that the controller in the injunction claimed a particular degree of trust and thereby significantly influenced the contract negotiations or the conclusion of the contract between the data subject in the injunction and third parties. The controller would have to have acted as a representative or negotiating agent on its own behalf, as it were; this would be the case above all if it were to be regarded as the economic master of the transaction or actually the economic party with an interest. A merely indirect interest, as the case with an intermediary or broker, is not sufficient. However, the interest of the controller in the injunction must be weighted much lower. For the latter, it is simply irrelevant whether the contractual partner it provides information to and the data subject in the injunction conclude a contract. In addition, duties to protect are not enforceable pursuant to Section 241 (2) BGB, so that a claim for the issuance of a preliminary injunction with the content requested by the data subject for the injunction does not even in the event of the existence of a contractual obligation pursuant to Sections 311 (3), 241 (2) BGB. c) The Regional Court also rightly rejected claims arising from agency without authority. The data subject in the injunction claims that the pursuit of an own interest by the controller in the injunction does not preclude the assumption of a management without mandate. The will to conduct business for third parties is present, as this is assumed here. However, this is ultimately irrelevant, as there is no enforceable obligation to continue the business even if the requirements for management without mandate are met. d) The GDPR does not provide the data subject with a basis for a claim either. As a result, the data subject in the injunction seeks the (re)commencement of the processing of personal data by the controller in the form of scoring and the transmission of the scoring value to third parties. This is a claim in connection with data processing. In this respect, however, the data subject in the injunction is only entitled to the rights of data subjects under Chapter III of the GDPR. According to this, however, data subjects can only demand that a data controller carry out data processing to the extent that incorrect personal data is corrected (Article 16 GDPR), personal data is deleted (Article 17 GDPR), former recipients of personal data are informed of a correction, deletion or restriction of the processing of personal data (Article 19 GDPR) or personal data is made available for transfer under certain circumstances (Article 20 GDPR). The data subject in the injunction does not assert any such claims. There is therefore no basis for the claims asserted by him under data protection law. e) The applicant is also not entitled to a claim under Sections 823 et seq. and 1004 BGB by analogy due to violation of the data subject's general right of personality. 23(1) The application under 1. is an application for performance (see below), so that the objective of the claim cannot be achieved by means of a claim under Section 1004 BGB (analogously) aimed at eliminating a disturbance or refraining from future disturbances. 24(2) Recourse to Section 1004 BGB (analogous) is also ruled out with regard to the application under 2. The score block imposed by the controller in the injunction is not unlawful. 25 the data subject in the injunction objected to the data processing in its previous form in the main proceedings, the controller in the injunction restricted the data processing. Article 18 GDPR generally provides for such a restriction of data processing, which is why this cannot unlawful from the outset under data protection law. Furthermore, the creditworthiness notifications associated with the transmission score values are expressions of opinion (see OLG Munich, judgment of 12.03.2014, 15 U 2395/13, ZD 2014, 570). In this context, the general right of personality protects, for example, against distorting or falsifying representations that could significantly impair the development of personality. However, there is no such distorting or falsifying representation of the data subject in the injunction. The non-publication of a score value constitutes a non-statement; the controller in the injunction order refrains from expressing an opinion about the data subject in the injunction order. Nor does any unlawful impairment of the rights of the data subject in the injunction arise from the notifications of the controller in the injunction to third parties that a score value is not communicated or cannot be calculated. Firstly, there is also no distorting or falsifying representation of the data subject in this respect. In particular, this notification does not any conclusions to be drawn about the creditworthiness or other financial circumstances of the data subject. Moreover, the controller already provides information about the data subject, such as reports on payment defaults or existing contractual relationships, but no longer a score. Secondly, the decision of the controller in the injunction to no longer provide information on the score values of the data subject in the injunction is in any case supported by a factual reason (cf. LG Wiesbaden, judgment of 05.04.2024 - 2 O 35/24, n. v.). Within the framework of Article 18 GDPR, the controller is initially required to itself only to the storage of the data in question, since the data subject's consent to the processing of certain data has not been declared (see LG Stuttgart, judgment of 06.09.2023 - 53 O 167/23, n. v.). In addition, the consequences for the controller in the injunction are ultimately unforeseeable if it were to further information. If the data subject in the injunction wishes to obtain further information, he must declare a clear, comprehensive and legally effective waiver of claims for damages, which, however not only the status quo, but also the information - based on previous processing practice - that the controller in the injunction owes to its own contractual partners on an ongoing basis. Therefore, when assessing the objective reason in such a case, the relationship between the parties here must not only be considered in isolation from other circumstances. The contractual partners expect the controller to communicate the score values in accordance with its general principles, as this is the only way to reliably classify them (see LG Stuttgart, judgment of September 6, 2023 - 53 O 167/23, n. a.). f) Finally, insofar as the data subject in the injunction refers to the controller's dominant market position, the ARC is not applicable because the data subject in the injunction is not an undertaking. A possible obligation of the controller under Section 826 of the German Civil Code (BGB) cannot be considered, as the conditions for the assumption of immorality are clearly not met. The controller in the injunction has a legitimate interest in not creating the score for the data subject in the injunction. It wants to minimize its risks that have arisen as a result of the legal action taken by the controller against the creation of the score. The fact that the controller in the injunction chooses the safe route for the time being to avoid further risks and does not create a score for the data subject in the injunction is a comprehensible course of conduct that far from immoral. It should be added that the controller continues to provide other information on the data subject's creditworthiness and payment history. 2 Furthermore, there is also no reason for an injunction. In this case, the data subject in the injunction seeks to order the controller in the injunction to lift the block on the data stored by it and the block on the provision of information and to calculate and provide information on score values for its contractual partners on request. In doing so, he is in part superficially asserting a request for injunctive relief, but ultimately he is claiming a service, so that the issue here is the issuance of a so-called service order. Significant disadvantages, such as those specified by law in Section 940 ZPO, which need to averted with the help of an interim injunction for the purpose of regulating a temporary situation, are not for the issuance of an interim injunction ordering the final fulfillment of the claim in dispute. Not even the imminent loss of the ability to fulfill the original claim to performance (in particular) for reasons of time is sufficient in itself. 3 Rather, the data subject in the injunction must demonstrate in the individual case - and make it credible - that he is so urgently dependent on the immediate fulfillment of his claim for performance and would otherwise suffer such considerable economic disadvantages that he cannot reasonably expected to wait or refer to the later assertion of claims for damages after the original claim for performance has ceased to exist. There is no evidence such particular urgency from the submission. In particular, it has not been demonstrated that it is impossible to prove his creditworthiness to more than one credit institution by other means in the specific case, over and above the score information generally required in banking transactions. Nor has it been credibly demonstrated that the data subject in the injunction order must specifically fear the termination of current contracts. 38 It may be that the data subject will be subject to difficulties when concluding certain contracts, but these can be remedied and compensated for. 4 The data subject in the injunction primarily refers to the general statements of the ..., the ... and However, these do not specifically concern him. The controller in the injunction has disputed the corresponding submission. The legal representatives also submit the same letters in parallel proceedings for other data subjects, see, for example, the statements of the Oldenburg Higher Regional Court, reference order of July 17, 2024, Ref. 13 U 66/24. The controller in the injunction has - undisputedly - submitted that the data subject in the injunction has the meantime been able to open a new current account with ... was able to open one. On June 13, 2024, the controller was notified by the ... In addition, a new credit card with the number ... had been registered. On October 11, 2024, the ... also notified the controller to the data subject of the opening of a new current account with the account number ... . This account also supports the "A. P." and "Sofortüberweisung" functions requested by the data subject, which the data subject demanded in his affidavit of February 29, 2024 (Exhibit ASt5). Shortly before the hearingthe data subject added that he had a loan application to V. AG on October 18, 2024. The loan could not be granted to him, among other things, due to the block imposed by the controller. The controller argued that the loans offered by V. AG were not suitable for the real estate financing or the modification of the apartment presented by the data subject as urgent. V. AG describes itself as a "provider of short-term loans" and offers loans to customers. up to a maximum of EUR 3,000.00 and first-time customers a maximum of EUR 1,000.00, a maximum credit period of 90 days. The data subject in the injunction no longer responded to this, so that the submission is to be regarded as conceded in accordance with Section 138 III ZPO (German Code of Civil Procedure) Significant economic disadvantages, which - if they were based on an unlawful act by the controller in the injunction - could no longer be compensated, are therefore not recognizable with sufficient certainty. 3 It can therefore be left open whether the action of the data subject in main proceedings before the Münster Regional Court to prohibit the score used by the controller in the injunction and at the same time to demand its unrestricted use from the controller in the summary proceedings constitutes contradictory conduct that violates Section 242 BGB.
Comment
Unfortunately the beck-Verlag is the only source for this edition and it's only behind a paywall
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
