BGH - I ZR 186/17
From GDPRhub
| BGH - I ZR 186/17 | |
|---|---|
 | |
| Court: | BGH (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(1) GDPR Article 80(2) GDPR |
| Decided: | 27.03.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | I ZR 186/17 |
| European Case Law Identifier: | |
| Appeal from: | CJEU C-757/22 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Rewis (in German) |
| Initial Contributor: | tjk |
The Federal Court of Justice ruled that qualified entities (such as certain consumer organisations) are authorised to bring legal action for violations of GDPR information obligations under consumer protection law, regardless of the specific violation and without the authorisation of a data subject.
English Summary
Facts
The Federal Union of Consumer Organisations and Associations (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV), a German consumer association, brought an action before the Regional Court of Berlin (Landesgericht Berlin – LG Berlin), claiming that Meta Platforms Ireland Ltd (the controller) failed to comply with the legal requirements to obtain valid consent from the users of its app centre under the GDPR because the controller had not fulfilled its information obligations. The action was brought independently of a specific infringement of a data subject’s GDPR rights and without a mandate from a specific data subject.
The LG Berlin upheld the action; the controller appealed this decision before the Higher Regional Court of Berlin (Kammergericht Berlin – KG Berlin). This appeal was dismissed and the controller further appealed the judgement of KG Berlin before the Federal Court of Justice (Bundesgerichtshof – BGH).
The BGH had doubts as to the admissibility of the action brought by the Federal Union. Therefore, it referred a question to the CJEU for a preliminary ruling on the interpretation of Article 80(1), 80(2) and 84(1) GDPR.
The CJEU ruled on 11 July 2024 in C‑757/22, Meta Platforms Ireland (Representative action) that a violation of the controller’s information obligation can be subject to a representative action under Article 80(2) GDPR.
Holding
The BGH ruled - implementing the CJEU's decision -, that qualified entities are authorized, pursuant to the German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG) and the German Injunctive Relief Act (Unterlassungsklagegesetz - UKlaG), to bring legal action before the civil courts for violations of information obligations pursuant to Article 12(1) GDPR in conjunction with Article 13(1)(c) and (e) GDPR, regardless of the specific violation of the rights of individual data subjects and without the consent of a data subject, for violations of the UWG, a consumer protection law within the meaning of the UKlaG, and the use of invalid general terms and conditions pursuant to the UKlaG.
The court also held, that the violation of the data protection information obligations pursuant to Article 12(1) GDPR in conjunction with Article 13(1)(c) and (e) GDPR also constitutes a violation of fair trade law under the aspect of withholding essential information pursuant to the UWG.
Additionally, the court held, that based on the economic importance of the processing of personal data for internet-based business models the GDPR's information obligations are of central importance to ensure that the consumer is comprehensively informed about the implications of his consent. This, the court stated, is because the consumer must be able to make an informed decision when consenting to the processing of personal data that is linked to a consumer's commercially relevant decision.
The court also stated, that the use of internet based business models can be compensated for by the data subject by disclosing personal data.
Comment
On the same day the court issued a related decision in BGH - I ZR 223/19 (and I ZR 222/19) regarding the possibility to bring actions under competition law for GDPR violations.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Federal Court of Justice
I ZR 186/17
dated March 27, 2025
App Center III
REWIS: LEGAL TECHNOLOGY URL: https://rewis.io/s/u/Jqy/
Database for case law of the Federal Court of Justice
Information without guarantee. 1st Civil Senate
© REWIS UG (limited liability) 2 I ZR 186/17 dated March 27, 2025 | rewis.io
I ZR 186/17 dated March 27, 2025
Judgment | Federal Court of Justice | 1st Civil Senate
Guiding Principle
App Center III
1. Qualified entities are authorized, pursuant to Section 8 (3) No. 3 of the Unfair Competition Act (UWG) and Section 3 (1) Sentence 1 No. 1 of the UKlaG, to bring legal action before the civil courts for violations of information obligations pursuant to Article 12 (1) Sentence 1 GDPR in conjunction with Article 13 (1) Letters c and e GDPR, regardless of the specific violation of the rights of individual data subjects and without the consent of a data subject, for violations of the Act against Unfair Competition, a consumer protection law within the meaning of Section 2 (2) No. 13 of the UKlaG, and the use of invalid general terms and conditions pursuant to Section 1 of the UKlaG.
2. The violation of the data protection information obligations pursuant to Art. 12 (1) Sentence 1 and Art. 13 (1) Letters c and e of the GDPR also constitutes a violation of fair trade law under the aspect of withholding essential information pursuant to Section 5a (1) of the Unfair Competition Act.
3. Based on the economic importance of the processing of personal data for internet-based business models, the use of which the consumer compensates for by disclosing personal data, the information obligations pursuant to Art. 12 (1) Sentence 1 and Art. 13 (1) Letters c and e of the GDPR are of central importance in order to ensure that the consumer, when consenting to the processing of personal data linked to a request decision, is informed as comprehensively as possible about the scope and implications of this declaration of consent in order to be able to make an informed decision.
Tenor
The appeal against the judgment of the 5th Civil Senate of the Higher Regional Court of September 22, 2017, is dismissed at the defendant's expense.
As a matter of law
Facts 3 I ZR 186/17 of March 27, 2025 | rewis.io
1
The plaintiff is the Federal Association of Consumer Organizations of the German Federal States, registered in the list of qualified institutions pursuant to Section 4 of the UKlaG.
The defendant, Meta Platforms Ireland Limited (formerly Facebook Ireland Limited), based in Ireland, operates the Facebook internet platform at www.facebook.de, which serves the exchange of personal and other data. A sister company of the defendant, Facebook Germany GmbH, based in Germany, advertises the availability of advertising space on the internet platform and supports local advertising clients of the defendant.
The defendant is the contractual partner for advertising clients in Germany. The defendant also processes the data of Facebook's German customers. The parent company of the defendant and Facebook Germany GmbH is based in the United States of America.
2 The Facebook internet platform contains a so-called "App Center" where the defendant provides its users with, among other things, free games from third-party providers. When accessing the App Center on
November 26, 2012, the game "The Ville" was offered there, with the following information appearing under
a "Play Now" button:
By clicking on "Play Game" above, this application receives:
- Your general information (?)
- Your email address
- About You
- Your status updates
This application may post on your behalf, including your score and more.
3 It also contained the following notice:
By continuing, you agree to The Ville's Terms and Conditions and
Privacy Policy.
The general terms and conditions and privacy policy were accessible via an electronic link. Corresponding notices also appeared under the "Play Now" button for the games "Diamond Dash" and "Wetpaint Entertainment." For the game "Scrabble," the notices ended with the sentence:
This application may post status updates, photos, and more in your name.
4 The plaintiff objects to the presentation of the notices provided under the "Play Now" button in the App Center as unfair, among other things, under the aspect of a breach of law due to a violation of statutory requirements for obtaining effective data protection
consent from the user. 4 I ZR 186/17 of March 27, 2025 | rewis.io
Furthermore, he considers the concluding notice for the game "Scrabble" to be a general term and condition that unreasonably discriminates against the user.
... 5 The plaintiff has applied for an order prohibiting the defendant, under penalty of administrative fines, from:
1. presenting games in a so-called "app center" on the website www.facebook.com, as part of commercial transactions with consumers with a permanent residence in the Federal Republic of Germany, in such a way that, by clicking a button such as "Play game," the consumer declares that the game operator receives information about the personal data stored there via the social network operated by the defendant and is authorized to transmit (post) information on behalf of the consumer, as shown in the screenshots reproduced [not printed here];
2. To include the following provisions or provisions equivalent to these in agreements with
consumers who have their habitual residence in the Federal Republic of Germany
regarding the use of applications (apps) within a social network,
and to invoke the provisions regarding the transfer of data to the operators of the games:
This application may post status updates, photos, and more in your name.
6 The plaintiff has also claimed compensation from the defendant for warning costs in the amount of
€200 plus interest. He brought this action
independently of any specific violation of the data protection rights of a
data subject and without the consent of such a person.
7 The Regional Court convicted the defendant as requested (LG Berlin, ZD 2015,
133). The defendant's appeal was unsuccessful (KG, GRUR-RR 2018,
115). The defendant is pursuing its motion to dismiss the action with its appeal, which was admitted by the Court of Appeal and which the plaintiff is requesting to be dismissed. 8 By order of May 28, 2020 (I ZR 186/17, GRUR 2020, 896 = WRP 2020, 1182
- App-Zentrum I), the Senate stayed the proceedings and referred the following question on the interpretation of Chapter VIII, in particular Article 80(1) and (2) and Article 84(1) GDPR, to the Court of Justice of the European Union for a preliminary ruling to clarify the legal situation under Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, which entered into force during the appeal proceedings and is relevant for the future injunction applications: 5 I ZR 186/17 of March 27, 2025 | rewis.io
Do the provisions in Chapter VIII, in particular Article 80 (1) and (2) and Article 84 (1) GDPR, conflict with national regulations that – in addition to the intervention powers of the supervisory authorities responsible for monitoring and enforcing the Regulation and the legal remedies available to data subjects – grant competitors, on the one hand, and associations, institutions, and chambers authorized under national law, on the other, the power to take action against the infringer for violations of the General Data Protection Regulation, regardless of the violation of specific rights of individual data subjects and without the consent of a data subject, by way of a civil court action under the aspects of the prohibition of unfair commercial practices or violation of consumer protection law or the prohibition of the use of invalid general terms and conditions?
9 The Court of Justice of the European Union ruled on this matter in its judgment of April 28, 2022 (C-319/20, GRUR 2022, 920 = WRP 2022, 684 - Meta Platforms Ireland) as follows:
Article 80(2) GDPR is to be interpreted as not precluding a national provision under which an association for the protection of consumer interests may bring legal action against an alleged infringer of personal data protection without a corresponding mandate and regardless of the violation of specific rights of data subjects on the grounds that the prohibition on engaging in unfair commercial practices, a consumer protection law, or the prohibition on using invalid general terms and conditions has been violated, provided that the data processing in question may affect the rights of identified or identifiable natural persons under that Regulation.
10 On July 22, 2022, the defendant issued a cease-and-desist declaration to the plaintiff, subject to a penalty clause, relating to the prohibitions sought in the claims. Furthermore, it undertook to reimburse the court and out-of-court costs of the proceedings (court and attorney fees under the Court Act (GKG) and the Court Act (RVG)) and to make a similar admission of costs in the present appeal proceedings pursuant to Section 307 of the Code of Civil Procedure (ZPO). The plaintiff neither accepted nor rejected the cease-and-desist declaration.
11 By order of November 10, 2022 (I ZR 186/17, GRUR 2023, 193 = WRP 2023, 189 - App-Zentrum II), the Senate again stayed the proceedings and referred the following question to the Court of Justice of the European Union for a preliminary ruling on the interpretation of Article 80 (2) GDPR:
Is an infringement of rights "as a result of processing" within the meaning of Article 80 (2) GDPR
asserted if an association for the protection of consumer interests bases its action
on the allegation that the rights of a data subject have been violated because the information obligations pursuant to Article 12 (1) sentence 1 GDPR in conjunction with Article 13 (1) GDPR have not been met? 6 I ZR 186/17 of March 27, 2025 | rewis.io
letters c and e of the GDPR regarding the purpose of the data processing and the recipient of the personal data have not been met?
12 The Court of Justice of the European Union ruled on this point in its judgment of July 11, 2024 (C-757/22, GRUR 2024, 1357 = WRP 2024, 1049 - Meta Platforms Ireland
(Representative action)) as follows:
Article 80(2) GDPR must be interpreted as meaning that the requirement that an authorized entity, in order to be able to bring a representative action within the meaning of that provision,
must assert that, in its view, the rights of a data subject provided for in that Regulation have been infringed "as a result of processing" within the meaning of that provision,
is met if that entity claims that the infringement of that person's rights occurs during the processing of personal data
and is based on a failure to comply with the obligation incumbent on the controller pursuant to Article 12(1), first sentence, and Article 13(1)(c) and e of the Regulation, it is incumbent on the data subject to provide information about the purpose of the data processing and the recipients of the data in a precise, transparent, understandable, and easily accessible form, using clear and plain language, at the latest when the data is collected.
Reasons for the Decision
13 A. The Court of Appeal found the claims to be well-founded.
In this regard, it stated:
14 The injunction application directed against the design of the App Center
under 1 is justified from the perspective of a breach of law pursuant to Section 8 (1) of the Unfair Competition Act (UWG).
This design is to be regarded as an unfair commercial practice pursuant to Section 3 (1) of the Unfair Competition Act (UWG) because it violates statutory provisions within the meaning of Section 4 (11) of the UWG (old version) and Section 3a of the UWG. The defendant, through the contested design of the "App Center," violated Section 28 (3) Sentence 1, Section 4, Section 4a
Section 1 Sentences 1 and 2 of the Federal Data Protection Act (BDSG) (old version) and Section 13 (1) Sentences 1 and 2 of the Telemedia Act (old version). These data protection provisions also serve to protect consumers and constitute market conduct regulations within the meaning of Section 4
No. 11 of the Unfair Competition Act (UWG) (old version) and Section 3a of the Unfair Competition Act (UWG).
15 The fact that the defendant is domiciled in Ireland does not preclude the applicability of German data protection law. According to Article 4 (1) (a) of
Directive 95/46/EC on the protection of individuals with regard to the processing
of personal data and on the free movement of such data, the decisive factor is whether the
defendant has an establishment in Germany and whether the processing of the data in question takes place in the course of its activities. These
conditions are met with regard to the defendant's German sister company (Facebook Germany GmbH).
16 7 I ZR 186/17 of March 27, 2025 | rewis.io
The contested presentation of the games in the App Center does not comply with the
requirements for obtaining effective data protection consent pursuant to Section 4a (1), Sentences 1 and 2, of the Federal Data Protection Act (BDSG) (old version). Due to the contested
design of the App Center, it remains unclear which data would be released for further transfer and what purpose the transfer serves. The
transfer of user data to the respective game operators based on this design of the App Center therefore violates Section 4, Section 4a (1)
and (2), and Section 28 (3), Sentence 1, of the Federal Data Protection Act (BDSG) (old version).
17 The injunction claim under item 2, directed against the use of the notice "This application may post status updates, photos, and more in your name" during the presentation of the game "Scrabble," is justified under Section 1 of the UKlaG (United Kingdom Act). This notice is a general term and condition that unreasonably disadvantages the user under Section 307 of the German Civil Code (BGB).
18 The claim for reimbursement of the warning costs is justified under Section 12 (1) Sentence 2 of the Unfair Competition Act (UWG).
19 B. The defendant's admissible appeal on points of law is unsuccessful.
20 I. The action is admissible.
21 1. The German courts have international jurisdiction over the action.
22 a) The international jurisdiction of German courts, which must also be examined ex officio in the appeal court under Section 545 (2) of the Code of Civil Procedure (ZPO) (established case law; see Federal Court of Justice, judgment of November 7, 2019 - I ZR 222/17, GRUR 2020,
647 [juris para. 22] = WRP 2020, 730 - Club Hotel Robinson; judgment of November 21, 2024 - I ZR 107/23, GRUR 2024, 1897 [juris para. 15] = WRP 2025, 62
- DFL Supercup), arises from Article 5 No. 3 of the Brussels I Regulation (now Article 7 No. 2 of the Brussels Ia Regulation). Under this provision, a person domiciled
in the territory of a Member State may be sued in another Member State in the courts for the place where the harmful event occurred or may occur, if the proceedings concern a tort, delict, quasi-delict, or matters relating to such a tort.
According to Article 60(1)(a) of the Brussels I Regulation (now Article 63(1)(a) of the Brussels I Regulation), companies are domiciled at the place where their registered office is located for the purposes of the Regulation. The defendant is domiciled in Ireland
and therefore has its registered office in another Member State.
23 b) The unlawful acts pursuant to Article 5 No. 3 of the Brussels I Regulation also include
unlawful acts of competition, such as those that are the subject of the injunction application under 1 (cf. Federal Court of Justice, judgment of 14 January 2016 -
I ZR 65/14, GRUR 2016, 946 [juris para. 15] = WRP 2016, 958 - Freunde finden, 8 I ZR 186/17 of 27 March 2025 | rewis.io
with further references). The Court of Appeal correctly assumed, and this was not challenged by the appeal, that the use of abusive general terms and conditions challenged in claim 2 also falls within the scope of Article 5 No. 3 of the Brussels I Regulation (see Federal Court of Justice, judgment of July 9, 2009 - Xa ZR 19/08, BGHZ 182, 24 [juris para. 12]; judgment of April 29, 2010 - Xa ZR 5/09, NJW 2010, 1958 [juris para. 10]; Stadler/Krüger in Musielak/Voit, ZPO, 21st ed., Brussels I Regulation Art. 7 para. 17; Köhler in Köhler/Feddersen,
UWG, 43rd ed. Introduction, para. 5.45). The same applies with regard to Art. 7 No. 2 of the Brussels Ia Regulation.
24 c) The phrase "place where the damaging event occurred"
refers to both the place of the causal event and the place where the damage occurred (cf. Federal Court of Justice, judgment of September 29, 2016 - I ZR 160/15, GRUR 2017, 283 [juris para. 15] = WRP 2017, 298 - Service fee,
with further references). According to the principles applicable to
competition practices, the place where the damage occurred is within Germany. The presentation of games on the Facebook platform, which is challenged in the action, is directed
at domestic recipients.
25 2. The procedural standing, which the appeal court must examine without being bound by the factual findings made by the appeal court,
(cf. BGH, GRUR 2020, 896 [juris para. 32] - App-Zentrum I, with further references), is also
present.
26 a) Before the General Data Protection Regulation entered into force, the plaintiff was entitled, pursuant to
Section 8 (3) No. 3 of the Unfair Competition Act (UWG) and Section 3 (1) Sentence 1 No. 1 of the UKlaG, to pursue the claims by way of action before the civil courts (cf. BGH,
GRUR 2020, 896 [juris paras. 24 to 28] - App-Zentrum I).
27 b) This originally existing procedural standing (cf. BGH, GRUR
2020, 896 [juris para. 32] - App-Zentrum I, with further references) did not cease to exist with the entry into force of the General Data Protection Regulation on May 25, 2018 (Article 99 (2) GDPR).
28 aa) Based on the plaintiff's claim, which, as a consumer association, alleges a violation of the defendant's duty to provide information regarding the purpose and scope of a user's consent to the processing of his or her personal data (cf. Federal Court of Justice, GRUR 2020, 896 [juris] para. 19 - App-Zentrum I), the admissibility of the action in the present case depends on whether, after the entry into force of the General Data Protection Regulation, qualified entities are entitled, pursuant to Section 8 (3) No. 3 of the Unfair Competition Act (UWG) and Section 3 (1) Sentence 1 No. 1 of the UKlaG (University Law on the Enforcement of Unfair Competition Act),
to enforce a consumer protection law within the meaning of Section 2 (2) for violations of this Regulation, regardless of the specific violation of the rights of individual data subjects and without the consent of a data subject, for violations of the Act against Unfair Competition. rewis.io
No. 13 UKlaG and the use of an invalid general
terms and conditions pursuant to Section 1 UKlaG by way of a lawsuit before the
civil courts (BGH, GRUR 2020, 896 [juris para. 17 and paras. 55 to 62] -
App-Zentrum I; GRUR 2023, 193 [juris para. 11] - App-Zentrum II). This is determined
by whether the relevant provisions of German law regarding
standing to sue pursuant to Section 8 (3) No. 3 of the Unfair Competition Act (UWG) and pursuant to Section 3 (1) Sentence 1 No. 1 of the UKlaG (United Kingdom Law) are compatible with the requirements set out in Article 80 (2) of the GDPR (see ECJ, GRUR 2022, 920 [juris paras. 49 and 62] - Meta Platforms Ireland;
Federal Court of Justice, GRUR 2023, 193 [juris para. 10] - App-Zentrum II).
29 bb) The Court of Justice of the European Union has ruled that Article 80 (2) GDPR can provide an appropriate basis for prosecuting violations of the General Data Protection Regulation by associations under the Act against Unfair Competition and the Injunctions Act (see
ECJ, GRUR 2022, 920 [juris para. 79] - Meta Platforms Ireland).
30 (1) Pursuant to Article 80(2) GDPR, Member States may provide that any of the bodies, organizations, or associations referred to in paragraph 1 of this Article shall, irrespective of whether or not they have been mandated by the data subject in that Member State, have the right to lodge a complaint with the supervisory authority competent pursuant to Article 77 GDPR and to exercise the rights listed in Articles 78 and 79 GDPR (here: the right to an effective judicial remedy against controllers or processors pursuant to Article 79 GDPR) if they consider that the rights of a data subject under the Regulation have been infringed as a result of processing.
31 (2) The provision of Article 80(2) GDPR has given Member States discretion regarding its implementation. In order for the representative action provided for in
Article 80(2) GDPR to be brought,
the Member States must make use of the option granted to them by this provision
to provide for this type of representation
of data subjects in their national law (see ECJ, GRUR
2022, 920 [juris para. 59] - Meta Platforms Ireland). The decisive factor is therefore whether
the provisions at issue in the dispute regarding the standing of associations pursuant to Section 8(3) No. 3 of the Unfair Competition Act (UWG) and Section 3(1) Sentence 1 No. 1 of the UKlaG fit within the scope of the discretion granted to each Member State by Article 80(2) GDPR. This scope must be determined by interpretation, taking into account the wording of Article 80(2) GDPR as well as the
system and objectives of the General Data Protection Regulation (cf.
ECJ, GRUR 2022, 920 [juris para. 62] - Meta Platforms Ireland). It must be taken into account that the option opened up to Member States in Article 80(2) GDPR
to provide for representative action proceedings against the alleged
violator of personal data protection is subject to a number of requirements regarding the personal and material scope of application (ECJ, GRUR 2022, 920 [juris para. 63] - Meta Platforms Ireland).
32 cc) In the present case, both the requirements regarding the personal scope of application and the material scope of application of Article 80 (2) GDPR are met.
33 (1) The standing granted to the plaintiff by Section 8 (3) No. 3 of the Unfair Competition Act (UWG) and Section 3 (1) Sentence 1 No. 1 of the UKlaG (United Kingdom Law on Unfair Competition)
falls within the personal scope of application of Article 80 (2) GDPR. As an association protecting consumer interests, the plaintiff meets the requirements set out in Article 80 (1) GDPR regarding the standing of a non-profit body, organization, or association (see ECJ, GRUR 2022, 920 [juris paras. 65 et seq. and 79] - Meta Platforms Ireland; GRUR 2024, 1357 [juris para. 41] - Meta Platforms Ireland
[representative action]; Federal Court of Justice, GRUR 2023, 193 [juris para. 16] - App-Zentrum II).
34 (2) The action also alleges a violation of the data protection rights of a data subject within the meaning of Article 80 (2) GDPR.
In this respect, it is irrelevant that the plaintiff brought his action independently of the
specific violation of the data protection rights of a data subject and
without the consent of such a person (cf. Federal Court of Justice, GRUR 2020, 896 [juris] para. 7 - App-Zentrum I; GRUR 2023, 193 [juris] para. 18 - App-Zentrum II; ECJ, GRUR 2022, 920 [juris para. 36] - Meta Platforms Ireland), but the subject of the
claim is solely the abstract review of the defendant's presentation of the App-Zentrum against the objective legal standard of
data protection law.
35 (a) The Court of Justice of the European Union has ruled that an entity within the meaning of Article 80 (2) GDPR cannot be required to individually identify in advance the person specifically affected by the processing of data that presumably violates the provisions of the General Data Protection Regulation. The term "data subject" within the meaning of Article 4 (1) GDPR includes not only an "identified natural person" but also an "identifiable natural person," i.e., a natural person who can be identified, directly or indirectly, by reference to an identifier such as, in particular, a name, an identification number, location data, or an online identifier. Under these circumstances, the designation of a category or group of persons affected by such processing may be sufficient for the filing of such a representative action (see ECJ, GRUR 2022, 920 [juris para. 68 et seq.] - Meta
Platforms Ireland; BGH, GRUR 2023, 193 [juris para. 18] - App-Zentrum II).
36 (b) The users of the
Facebook internet platform addressed by the design of the App Center, who were interested in playing a game offered there
and therefore potentially participated by clicking the button11 I ZR 186/17 of March 27, 2025 | rewis.io
"Sofort spielen" (Play Now) were able to declare their consent to the processing of their personal
data are identifiable natural persons within the meaning of the foregoing (Federal Court of Justice, GRUR 2023, 193 [juris para. 18] - App-Zentrum II).
37 (3) The plaintiff also asserts with his claims that, in his opinion, the rights of a data subject under
the General Data Protection Regulation have been violated "as a result of processing" within the meaning of
Article 80 (2) GDPR.
38 (a) According to the case law of the Court of Justice of the European Union, this requirement is met if the institution claims that the violation of that person's rights occurs during the processing of personal data and is based on a failure to comply with the controller's obligation under Article 12(1), first sentence, and Article 13(1)(c) and (e) of the Regulation to provide the data subject, at the latest at the time of data collection, with information about the purpose of the data processing and the recipients of the data in a concise, transparent, intelligible, and easily accessible form, using clear and plain language (ECJ, GRUR 2024, 1357 [juris para. 65] - Meta Platforms Ireland [representative action]).
39 (b) These requirements are met in the present case. The subject of the claims is the plaintiff's allegation that the defendant, with the contested design of its App Center, violated the obligation arising from Article 12 (1) sentence 1 and Article 13 (1) letters c and e of the GDPR to provide the data subject with information about the purpose of the data processing and the recipient of personal data in a precise, transparent, intelligible, and easily accessible form, using clear and plain language (see
Federal Court of Justice, GRUR 2020, 896 [juris para. 30] - App Center I; GRUR 2023, 193 [juris para. 27] - App Center II).
40 (c) The appeal on points of law unsuccessfully argues that the plaintiff failed to demonstrate, in accordance with the principles established by the
Court of Justice of the European Union on the interpretation of Article 80(2) GDPR, that the rights of a data subject
under the General Data Protection Regulation were infringed as a result of processing.
41 The Court of Justice of the European Union, referring to the
Advocate General's observations, has stated that the data processing
which the entity considers to be in breach of the provisions of the General Data Protection Regulation must exist and thus cannot be of a purely hypothetical nature (ECJ, GRUR 2024, 1357 [juris para. 44] - Meta Platforms Ireland
(representative action) in conjunction with para. 48 of the Advocate General's Opinion in Case C-757/22 of 25 January 2024). In the case in dispute,
it cannot be assumed that the plaintiff, with the action, is asserting non-existent and thus purely hypothetical violations of the information obligations arising from Article 12 (1) Sentence 1 and Article 13 (1) Letters c and e of the GDPR.
The specific content of the information provided in the App Center is undisputed. Furthermore, it is neither asserted by the appeal nor is it otherwise apparent that users of the Facebook internet platform actually did not use the App Center presented there by the defendant, in particular did not click the "Play Now" button, and thus did not trigger any data processing.
42 dd) Furthermore, standing under Article 80 (2) GDPR is not precluded by the fact that the plaintiff, by alleging a violation of the
provisions on the protection of consumer personal data, simultaneously alleges a violation of other provisions on consumer protection
and on combating unfair commercial practices (see ECJ,
GRUR 2022, 920 [juris para. 66 and paras. 77 to 82] - Meta Platforms Ireland; Federal Court of Justice,
GRUR 2023, 193 [juris para. 19] - App-Zentrum II).
43 II. The Court of Appeal correctly found the claims to be well-founded.
44 1. The conduct challenged in the injunction application under item 1 violates
regulations on the protection of consumers' personal data and
therefore also constitutes an unfair commercial practice pursuant to Section 3 (1)
of the German Unfair Competition Act (UWG), which the defendant is obligated to refrain from due to the risk of repetition (Section 8 (1) Sentence 1 of the UWG).
45 a) The claim for injunctive relief based on the risk of repetition is only
founded if the contested conduct was anti-competitive both under the law applicable at the time
it was committed and under the law applicable at the time of the appeal decision (established case law; see, for example, Federal Court of Justice, judgment of July 13, 2023 - I ZR 60/22, GRUR 2023, 1710 [juris] para. 18 = WRP 2024, 72 - Eigenlaborgewinn, with further references). This is the case in the present case. The presentation of games in the defendant's App Center, which is challenged by the injunction application under 1, violates both the data protection information obligations applicable at the time of the infringement pursuant to Section 13 (1) Sentence 1, Clause 1 of the Telemedia Act (TMG) and the now applicable provisions pursuant to Article 12 (1) Sentence 1 and Article 13 (1) Letters c and e of the GDPR (see B II 1 b). This also constitutes a violation of fair competition law under the aspect of withholding essential information pursuant to Section 5a (2) of the German Unfair Competition Act (UWG) in the version applicable at the time of the infringement on November 26, 2012 (old version) and Section 5a (1) of the German Unfair Competition Act (UWG) in the currently applicable version (new version) (see B II 1 c). Furthermore, the risk of repetition required for the asserted injunctive relief pursuant to Section 8 (1) Sentence 1 of the German Unfair Competition Act (UWG) exists (see B II 1 d).
4613 I ZR 186/17 of March 27, 2025 | rewis.io
b) The presentation of the App Center violated the data protection information obligations applicable at the time of its
presentation pursuant to Section 13 (1) Sentence 1, Clause 1 of the German Telemedia Act (TMG) (see B II 1 b aa) and also constitutes a
violation of the now applicable provisions pursuant to Article 12 (1) Sentence 1,
Article 13 (1) Letters c and e of the GDPR (see B II 1 b bb).
47 aa) The Court of Appeal rightly held that the contested presentation of games in the App Center on November 26, 2012, violated Section 13 (1) Sentence 1, Clause 1, of the Telemedia Act.
48 (1) Pursuant to Section 12 (1) of the Telemedia Act, a service provider may only collect and use personal data for the provision of telemedia if the Telemedia Act or another legal provision expressly referring to telemedia permits it, or if the user has consented. Pursuant to Section 13 (1) Sentence 1, Clause 1, of the Telemedia Act, the service provider must inform the user at the beginning of the usage process about the nature, scope, and purpose of the collection and use of personal data in a generally understandable form, unless such information has already been provided.
49 (2) The Court of Appeal correctly assumed that the applicability of this data protection provision, which is regulated under German law, is not precluded by the fact that the defendant is domiciled in Ireland (see Federal Court of Justice, GRUR 2020, 896 [juris para. 22] - App-Zentrum I).
50 Pursuant to Article 4(1)(a), first sentence, of Directive 95/46/EC, which was still in force at the time of the contested act, each Member State shall apply the provisions it adopts to implement that Directive to all processing of personal data carried out in the context of the activities of an establishment of the controller in the territory of that Member State. According to this provision, German data protection law, and thus also the provisions pursuant to Sections 12 and 13 of the Telemedia Act, are applicable.
51 In its judgment of June 5, 2018, regarding the relationship between the defendant, based in Ireland and responsible for the processing of the data relevant to the dispute, and its sister company, based in Germany and solely responsible for promoting the sale of advertising in Germany, the Court of Justice of the European Union ruled that the German sister company is to be regarded as an establishment of the defendant within the meaning of Article 4(1)(a) of Directive 95/46/EC, and that the data processing carried out by the defendant, based in Ireland, is deemed to be carried out "in the course of the activities" of the German establishment (see ECJ, judgment of June 5, 2018 - C-210/16, WRP 2018, 805 [juris paras. 55 and 60] -
Wirtschaftsakademie Schleswig-Holstein).
5214 I ZR 186/17 of March 27, 2025 | rewis.io
(3) The Court of Appeal also rightly assumed that the information in the App Center challenged by the claims did not meet the requirements
of Section 13 (1) Sentence 1 Clause 1 of the Telemedia Act. Based on the findings made by the Court of Appeal without legal error, the
defendant, contrary to Section 13 (1) Sentence 1 Clause 1 of the Telemedia Act, failed to inform the user at the beginning of the
usage process about the nature, scope, and purposes of the collection and
use of personal data in a generally understandable form.
53 (a) The Court of Appeal referred to the Regional Court's assessment and adopted its statements as its own. The Regional Court
assumed that the information provided by the defendant in the app center
did not meet the requirements for effective consent to the processing and use of personal data. In the disputed passage, the defendant
obtained general consent from the consumer to transmit "Your General Information," the email address, "About You," and status updates to a
third party, namely the app; furthermore,
the third party could access this information. Furthermore, the third party could
"post" on behalf of the consumer, namely the points balance "and more."
Which data would thus be released for (further) transfer to third-party companies,
in particular whether it included all of the data listed above,
remained completely unclear. Furthermore, there was no information about
the purpose of the transfer and what would happen to the data by the third party. In particular, according to the wording, the consent is not limited to the transmission of data necessary for the consumer to play the game with or in competition with other participants in the defendant's network. Rather, the consent encompasses "posting" for any purpose. The user who participates in the free game thereby loses all control over the whereabouts and use of their data. The fact that the transfer primarily concerns information that the user had previously made public within the network does not exonerate the defendant, because in this case, this information could leave the protected space of the network.
54 The link to the game provider's general terms and conditions and privacy policy is not sufficient to make the user aware of the consequences of their decision. The link is not only spatially separated from the consent to be granted via the defendant, but there is also a lack of a substantive reference that would enable the user to recognize the connection between the consent requested by the defendant to transmit the data to the game operator and the determination of the scope of data use by the general terms and conditions. It should also be considered that, from the perspective of the averagely attentive reference consumer, participation in a free game does not constitute an act whose consequences require careful consideration. In any case, the gaming instinct addressed here generally emanates a strong force, which is often given in to without much thought. In addition, between the text block containing the defendant's consent to data transfer and the information about the third party's use of the data, there is another text block concerning the options for sharing the posted data with specific user groups. This option is familiar and familiar to the network user from their other use of the defendant's service. It redirects their attention in a different direction and gives them the feeling that they have now taken care of everything necessary for participating in the game. For this reason, too, it cannot seriously be expected that the average, attentive reference consumer will laboriously click through the game provider's terms and conditions before clicking the "play now" button to find out how the provider intends to handle their data.
55 In addition to the district court's findings, the appeal court stated that the defendant had not
substantiated that a descriptive link to its own privacy policy
was directly related to the app center. The "Learn more about
your privacy and Facebook" link on the other Facebook pages was not helpful in this respect because, in any case,
consistent information for the consumer when deciding
about consenting to the respective data processing through the use of the app was lacking. With regard to the authorization of the game providers to post
on behalf of the player, the number and content of these posts could not even be foreseen by the consenting consumer, and such
data use was not sufficiently specifically restricted.
56 (b) This assessment, which essentially falls within the jurisdiction of the court of fact, is subject to only limited review in the appeal proceedings with regard to whether statutory principles of interpretation, laws of logic, or empirical principles have been violated, or whether the interpretation is based on procedural errors, for example, because essential interpretative material has been disregarded in violation of procedural rules (established case law; see Federal Court of Justice, judgment of May 29, 2024 - I ZR 145/23, BGHZ 241, 1 [juris para. 47] - warning under Trademark Law III, with further references). The appeal court did not commit any such legal errors. To the extent that the appeal challenges the assessment and asserts that, under the circumstances of the case, the defendant obtained effective consent from the users of the App Center, it merely substitutes its assessment for that of the appeal court without demonstrating any fundamental legal error.16 I ZR 186/17 of March 27, 2025 | rewis.io
57
bb) The contested presentation of the App Center also violates the
now applicable information obligations pursuant to Article 12 (1) sentence 1 and Article 13 (1) letters c and e GDPR.
58 (1) Pursuant to Article 12 (1) sentence 1 GDPR, the controller shall take appropriate measures to provide the data subject with all information pursuant to Articles 13 and 14 GDPR and all communications pursuant to Articles 15 to 22 and 34 GDPR relating to the processing in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Pursuant to Article 13 (1) GDPR, where personal data are collected from the data subject, the controller shall inform the data subject at the time of collection of the personal data: the purposes for which the personal data are to be processed, the legal basis for the processing (point (c)), and, where applicable, the recipients or categories of recipients of the personal data (point (e)).
59 (2) From the findings of the Court of Appeal already presented, which are free from legal errors, it follows that the contested presentation of the games in the defendant's App Center also fails to meet the requirements of the information obligations under Article 13 (1) GDPR.
60 c) The violation of the data protection information obligations
pursuant to Section 13 (1) Sentence 1 Clause 1 of the Telemedia Act (TMG) and Article 12 (1) Sentence 1, Article 13 (1)
letters c and e of the GDPR also constitutes a violation of fair trading law under the aspect of withholding essential information pursuant to
Section 5a (2) of the German Unfair Competition Act (UWG) (old version) or Section 5a (1) of the German Unfair Competition Act (UWG) (new version).
61 aa) However, in its requests for a preliminary ruling, the Senate assumed a violation of fair trading law under the aspect of a breach of law
pursuant to Section 3a of the German Unfair Competition Act (UWG). He does not adhere to this. In cases of withholding information essential to a consumer's business decision, the unfairness of a commercial practice is, according to the Senate's recent case law, to be assessed solely under Section 5a (2) of the UWG (old version)
or Section 5a (1) of the UWG (new version) (cf. Federal Court of Justice, judgment of July 11, 2024 - I ZR 164/23, GRUR 2024, 1449 [juris para. 21] = WRP 2024, 1345 -
nicotine-containing liquids, with further references).
62 bb) According to Section 5a (2) of the UWG (old version), anyone who influences the decision-making capacity
of consumers by withholding information that is essential in the specific case, taking into account all circumstances, including the limitations of the means of communication, acts unfairly. According to Section 5a (1) of the new version of the Unfair Competition Act (UWG), anyone who misleads a consumer or other market participant by withholding material information (No. 1) that the consumer or other market participant needs under the respective circumstances to make an informed business decision, and (No. 2) the withholding of which is likely to induce the consumer or other market participant to make a business decision that they would not otherwise have made, is deemed to be acting unfairly. According to Section 5a (2) No. 3 of the new version of the UWG, failure to provide material information in a timely manner is considered withholding.
63 cc) The defendant withheld material information from the users of the App Center within the meaning of these provisions.
64 (1) By failing to comply with the data protection information obligations pursuant to Section 13 (1) Sentence 1, first half-sentence, of the Telemedia Act (TMG) and Article 12 (1) Sentence 1, Article 13 (1) Letters c and e of the GDPR, when presenting the App Center, the defendant withheld information from its users within the meaning of Section 5a (2) of the German Unfair Competition Act (UWG) (old version) and Section 5a (1) and (2) No. 3 of the German Unfair Competition Act (UWG) (new version).
65 (2) This information is material within the meaning of these provisions.
66 (a) Whether materiality already arises from the presumption rules pursuant to
Section 5a (4) of the German Unfair Competition Act (UWG) (old version) and Section 5b (4) of the German Unfair Competition Act (UWG) (new version) is, however, doubtful in the case in dispute.
67 According to these provisions, information that may not be withheld from the consumer under EU regulations or under EU directives implementing EU directives on commercial communication, including advertising and marketing, is also considered material within the meaning of Section 5a (2) of the German Unfair Competition Act (UWG)
old version or Section 5a (1) of the new version. The provision in Section 5a (4) of the UWG (old version) (Section 5b (4) of the UWG (new version)) has its EU legal basis in Article 7 (5) of Directive 2005/29/EC concerning unfair business-to-consumer commercial practices within the internal market (see Federal Court of Justice, judgment of January 26, 2023 - I ZR 111/22, GRUR 2023, 585 [juris para. 58] = WRP 2023, 576
- Member structure, with further references). Accordingly, the information requirements established in Community law regarding commercial communications, including advertising or marketing, referred to in the non-exhaustive list in Annex II to Directive 2005/29/EC, are deemed to be material within the meaning of Article 7 of the Directive. Commercial communication in this sense, in accordance with Article 2(f) of Directive 2000/31/EC on electronic commerce, means all forms of communication that serve to directly or indirectly promote the sale of goods and services or the image of a company, organization, or natural person engaged in a trade, business, or craft activity or a regulated profession (Federal Court of Justice, judgment of October 26, 2023 - I ZR 176/19, GRUR 2023, 1704 [juris para. 22] = WRP 2024, 65 -18 I ZR 186/17 of March 27, 2025 | rewis.io
Cigarette Vending Machine III, with further references). Due to the lack of promotion of product sales
or the company's image, information obligations that serve other purposes
or that must be fulfilled in the course of concluding or executing the contract are generally not considered commercial
communication . This means that information obligations do not fall under the definition of
commercial communication if they only have to be fulfilled at the time of delivery of the previously ordered goods (see Federal Court of Justice,
decision of February 10, 2022 - I ZR 38/21, GRUR 2022, 500 [juris para. 66] =
WRP 2022, 452 - Satisfaction Guarantee; Federal Court of Justice, GRUR 2023, 1704 [juris para. 24] -
Cigarette Vending Machine III).
68 It is doubtful whether, based on the findings made by the Court of Appeal, it can be assumed that the activation of the "Play Now" button by consumers who are already users of the Facebook internet platform serves to directly or indirectly promote the sale of products or services or the company's image before the conclusion of the contract, or whether it represents a post-contractual decision by the consumer. It is therefore also doubtful whether the data protection information obligations to be fulfilled when presenting the App Center to users of the Facebook internet platform fall under the concept of commercial communication.
69 (b) However, these questions may be left aside in the event of a dispute. The relevant
data protection information obligations pursuant to Section 13 (1) Sentence 1
Clause 1 of the Telemedia Act (TMG) and Article 12 (1) Sentence 1, Article 13 (1) Letters c and e of the GDPR
are, without prejudice to the application of the presumption rule pursuant to Section 5a (4)
of the UWG (old version) and Section 5b (4) of the UWG (new version) in the situation to be assessed in the dispute, to be regarded as material within the meaning of
Section 5a (2) of the UWG (old version) and Section 5a (1) of the UWG (new version).
70 Accordingly, information is not material within the meaning of
Section 5a of the Unfair Competition Act (UWG) simply because it may be of
importance to the consumer's business decision, but only if its provision can be expected from the trader, taking into account the interests of both parties,
and if it also has significant weight for the consumer's business decision. While Section 5a of the UWG does result in
information obligations that go beyond what is necessary to
avoid misconceptions that would otherwise arise, the trader is not subject to a general duty to provide information about facts that
may be of importance to the business decision of the target public.
Whether information is of particular importance to the consumer's business decision depends on
the average consumer's expectations and level of understanding. The
assessment of whether information is material in the individual case, taking into account all19 I ZR 186/17 of March 27, 2025 | rewis.io
Whether these circumstances are to be considered material is a matter for the courts of the
member states (Federal Court of Justice, judgment of July 25, 2024 - I ZR 143/23, GRUR 2024, 1345
[juris para. 13 et seq.] = WRP 2024, 1056 - average star rating, with further references).
71 According to these standards, compliance with the data protection information obligations pursuant to Section 13 (1) Sentence 1 Clause 1 of the Telemedia Act (TMG) and Article 12 (1) Sentence 1, Article 13 (1) Letters c and e of the GDPR is of considerable importance for the
business decision of the user of the Facebook internet platform as to whether
they should click the "Play Now" button in the platform's app center.
72 According to Section 2 (1) No. 1 of the Unfair Competition Act (UWG), a commercial decision is any decision
of a consumer about whether, how, and under what conditions they wish to
conclude a transaction, make a payment, retain or dispose of a good or service,
or exercise a contractual right in connection with
a good or service, regardless of whether the
consumer decides to take action. This includes not only the
decision about whether or not to purchase a product, but also
directly related decisions such as entering a
store, visiting an online sales portal, or accessing a company's
website to learn more about the company or
its product range (Federal Court of Justice, judgment of May 29, 2024 - I ZR 43/23,
GRUR 2024, 1041 [juris para. 64] = WRP 2024, 933 - Hydra Energy, with further references). The term "commercial" distinguishes purely private from non-commercial activity (see Keller in Harte-Bavendamm/Henning-Bodewig,
Unfair Competition Act, 5th ed., Section 2, marginal no. 222 in conjunction with marginal no. 22). It is not necessary that the transaction be for consideration or that the consumer suffers a direct financial disadvantage as a result of their decision, so that the use of free services on the internet can also constitute a
commercial decision (see Omsels WRP 2016, 553, marginal nos. 43 to 45; Sosnitza in Ohly/Sosnitza, Unfair Competition Act, 8th ed., Section 2, marginal no. 4).
73 According to these standards, the decision to click the "Play Now" button in the app center of the Facebook internet platform and the associated consent to the processing of personal data is not merely a private decision, but a business decision. The obligation to provide information about the purpose and scope of the consent declaration, as regulated in Section 13 (1) Sentence 1, Clause 1 of the Telemedia Act, serves not only to protect personal rights, but at least also to protect the commercial interests of consumers. This provision implements Article 10 of Directive 95/46/EC into national law (cf. Higher Regional Court of Hamburg, WRP
2013, 1203, para. 40; Higher Regional Court of Cologne, WRP 2016, 885, para. 24; Schmitz in Spindler/Schmitz,
TMG, 2nd ed., Section 13, para. 127) and must therefore be interpreted in accordance with the directive. In this respect, it should be noted that Directive 95/46/EC as a whole not only serves to protect the personal rights affected by data processing (Article 1(1) and Recital 10 of the Directive). From 20 I ZR 186/17 of March 27, 2025 | rewis.io
Recital 2 ("development of trade"), 6 ("facilitating cross-border flows of personal data"), and especially
from Recitals 3, 7, 8, and 9, it emerges that the
Union legislature also considered the tension between the protection of personal rights and the free movement of data within the Union as an
economic factor. The purpose of the Directive is also to harmonize
national data protection provisions for the purpose of intra-Community trade in data while maintaining the protection of the fundamental rights of data subjects. Accordingly, Article 1
of Directive 95/46/EC stipulates not only that Member States shall ensure the protection of fundamental rights and freedoms, and in particular the protection of the privacy of natural persons with regard to the processing of personal data (paragraph 1), but also that Member States shall not restrict or prohibit the free movement of personal data between Member States on the basis of the rights protected in paragraph 1 of the provision (paragraph 2). The protection of the fundamental rights of data subjects is therefore not considered in isolation, but rather with regard to the functioning of the internal market (cf. OLG Cologne, WRP 2016, 885 para. 26). Directive 95/46/EC is therefore clearly based on the assumption that personal data can be the basis or even the subject of services or goods provided throughout the Union. Based on the economic importance
of processing personal data for internet-based
business models, the use of which often leads consumers to ask themselves, based on their life experience, whether to pay for desired services not by paying a fee, but by disclosing personal
data , the information obligations pursuant to Article 10 of
Directive 95/46/EC and Section 13 (1) of the Telemedia Act (TMG) are of central importance in order to
ensure that the consumer, when giving their consent to the processing of personal data linked to a request for information, is informed as comprehensively as possible about the scope and implications of this consent in order to be able to make an
informed decision.
74 The same applies to the information obligations pursuant to Article 12 (1) sentence 1,
Article 13 (1) letters c and e of the GDPR. These also serve to protect consumers. The General Data Protection Regulation aims, on the one hand, to protect fundamental rights and freedoms (Article 1 (1) GDPR), but also sets out provisions on the free movement of personal data (Article 1 (1) GDPR). Furthermore, according to Article 1 (3) GDPR, the free movement of personal data within the Union may neither be restricted nor prohibited for reasons of the protection of natural persons with regard to the processing of personal data. Technological development and globalization are explicitly addressed in Recital 6, and the Union-wide movement of personal data as an economic factor in the 21 I ZR 186/17 of March 27, 2025 | rewis.io
Recitals 2, 3, 5, 6, 7, and especially 9 and 10. Against this background,
the information obligations pursuant to Article 12 (1) sentence 1, Article 13 (1)
letters c and e GDPR are also intended to ensure that the consumer, when consenting to the processing of personal data linked to a decision to purchase goods or services, is
fully informed about the scope and implications of this declaration of consent.
75 The data protection information obligations stipulated by law in Section 13 (1) sentence 1, first half-sentence, of the Telemedia Act (TMG) and Article 12 (1) sentence 1, Article 13 (1)
letters c and e GDPR are therefore also essential within the meaning of Section 5a (2)
of the German Unfair Competition Act (UWG) (old version) and Section 5a (1) of the German Unfair Competition Act (UWG) (new version). As explained, they are intended to ensure that the consumer, when giving their consent to the processing of personal data linked to a purchase decision, is informed as comprehensively as possible about the scope and impact of this declaration of consent in order to be able to make an informed decision (Section 5a (1) No. 1 of the Unfair Competition Act (UWG) as amended). Fulfillment of these information obligations can be expected from the entrepreneur, taking into account the interests of both parties; they are of considerable importance for the informed decision to be made by the consumer regarding the act of clicking the "Play Now" button.
76 Since the data protection notification obligations in question
serve precisely to provide the consumer with the information that is
relevant for their consideration of the advantages and disadvantages of consent justifying data processing,
a violation is ultimately also
likely to induce the consumer to make a business decision that they would not otherwise have made (Section 5a (1) No. 2 of the Unfair Competition Act (UWG) as amended).
77 d) The Court of Appeal rightly assumed that the risk of repetition required for the asserted injunctive relief under Section 8 (1) Sentence 1 of the UWG existed.
78 aa) The risk of repetition is actually presumed due to the established infringement (cf. Federal Court of Justice, judgment of January 12, 2023 - I ZR 49/22, GRUR 2023, 742 [juris para. 14] = WRP 2023, 709 - submission by
PDF, with further references).
79 bb) It has not been eliminated by the cease-and-desist declaration, subject to penalty, made by the defendant during the appeal proceedings.
This declaration cannot be considered in the appeal proceedings pursuant to
Section 559 (1) Sentence 1 of the Code of Civil Procedure.
80 (1) Pursuant to Section 559 (1) Sentence 1 of the Code of Civil Procedure, the appeal court is only responsible for assessing those party submissions that are evident from the appeal judgment
or the minutes of the hearing. The basis for the judgment is concluded by the 22 I ZR 186/17 of March 27, 2025 | rewis.io
end of the appeal hearing; new facts may generally not be considered in the appeal proceedings (Federal Court of Justice, judgment of
November 21, 2001 - XII ZR 162/99, NJW 2002, 1130 [juris para. 12], with further references). The
general exclusion of new factual circumstances takes into account the nature
of the appeal court, which is not a matter of fact but a matter of law, and at the same time serves to relieve the appeal court of the additional workload
associated with establishing facts, in particular the gathering of evidence. The law accepts that, as a consequence of the exclusion, a judgment may be issued that does not correspond to the substantive legal situation and that a new legal dispute may become necessary (Federal Court of Justice, judgment of
July 9, 1998 - IX ZR 272/96, BGHZ 139, 214 [juris para. 15]).
81 According to the consistent case law of the Federal Court of Justice, Section 559 (1) Sentence 1
of the Code of Civil Procedure is, however, to be interpreted restrictively to the effect that, to a certain extent,
facts relevant to the substantive legal situation that only arise during
the appeal proceedings may also be taken into account in the decision, provided that they
are undisputed or their existence must be considered ex officio in the appeal proceedings anyway
and that the interests of the opposing party worthy of protection do not conflict with them. The idea of the appeal court concentrating on the
legal assessment of established facts loses weight if the consideration of new factual circumstances does not cause any
significant additional work and the interests of the opposing party are protected. Then there is room to consider that, for reasons of procedural economy, it is not responsible to refer the party affected by the
exclusion of facts to further proceedings, possibly through
several instances. In such a case, a
quick and definitive settlement of the dispute should be achieved by admitting new submissions in the appeal proceedings (see Federal Court of Justice, judgment of
March 23, 2023 - I ZR 17/22, BGHZ 237, 1 [juris para. 31] - Amino Acid Capsules,
with further references).
82 (2) According to these principles, the defendant's argument that it made a cease-and-desist declaration and undertaking is not to be considered in the appeal proceedings because it conflicts with the plaintiff's legitimate interests. The plaintiff has a legitimate interest in having the questions of EU and national law discussed above, which have not yet been answered conclusively, clarified by a decision of the Federal Court of Justice.
83 2. The Court of Appeal also rightly held that the injunction application under point 2, aimed at prohibiting the use of the statement "This application may post status updates,
photos, and more in your name," is well-founded. This statement constitutes an unreasonably discriminatory and therefore ineffective general right to object to the use of the statement "This application may post status updates,
photos, and more in your name" due to the violation of the data protection information obligations applicable in the dispute. rewis.io
constitutes a business term (see already BGH, GRUR 2020, 896 [juris para. 23] - App-
Center I).
84 a) The appeal court assumed that the information used by the defendant in
Germany is to be assessed in accordance with German law pursuant to
Sections 305 et seq. of the German Civil Code (BGB). This assumption does not reveal any legal error
and is not challenged by the appeal.
85 b) According to Section 307 (1) Sentence 1 of the German Civil Code (BGB), provisions in general terms and conditions are invalid if they unreasonably disadvantage the user's contractual partner contrary to the principles of good faith. According to Section 307 (1) Sentence 2 of the German Civil Code (BGB), unreasonable disadvantage may also arise from the fact that the provision is not clear and
understandable. According to Section 307 (2) of the German Civil Code (BGB), unreasonable discrimination is to be presumed
in case of doubt if a provision (No. 1) is incompatible with essential
principles of the statutory provision from which it deviates, or (No. 2) restricts essential rights or obligations arising from the
nature of the contract to such an extent that the achievement of the
purpose of the contract is jeopardized.
86 c) The Court of Appeal assumed that the statement "This
application may post status updates, photos, and more in your name"
is a general term and condition, i.e., a pre-formulated contractual term for a large number of
contracts that the defendant, as the user, has imposed on its customers as the other party within the meaning of Section 305 (1) Sentence 1 of the German Civil Code (BGB).
This assessment withstands review under the law of appeal.
87 aa) It is consistent with the protective purpose of the regulations governing the structuring of contractual obligations through general terms and conditions to also subject the unilateral contractual declarations of the other contracting party, pre-formulated by the user, to review under general terms and conditions. It is sufficient if the pre-formulated declaration, based on its objective wording, creates the impression in the recipient that it is intended to determine the content of a contractual or pre-contractual legal relationship. Other legally relevant declarations by the customer in connection with a contractual relationship are also subject to review under Sections 305 et seq. of the German Civil Code (BGB) (Federal Court of Justice, judgment of May 15, 2014 - III ZR 368/13, NJW 2014, 2857 [juris para. 30]). To distinguish between
general (binding) contractual terms and conditions and (non-binding) requests,
recommendations, or factual information, the recipient's perspective must be taken into account. A contractual term is therefore present if a general
information, based on its objective wording, creates the impression in the recipient that it is intended to determine the content of a contractual or pre-contractual
legal relationship. As with the interpretation of the content of general terms and conditions, the average customer, who is not legally trained, and the typical circumstances prevailing in this context must be taken into account. The distinction to be made by way of interpretation between legally binding contractual terms and non-binding declarations can be made by the appeal court itself (Federal Court of Justice,
judgment of April 9, 2014 - VIII ZR 404/12, BGHZ 200, 362 [juris paras. 24 et seq.]).
88 bb) The appeal court proceeded from these principles and correctly assumed that the statement in question was a contractual term within the meaning of Section 305 (1) of the German Civil Code (BGB) and not a mere non-binding indication.
89 (1) The appeal court assumed that the challenged statement contained, from the perspective of the users concerned, not only an explanatory
factual indication, but a legally binding regulation. The very wording "may ... post" suggests the granting of a binding permission
to post. The statement that a third party may make messages to other persons on behalf of the user speaks all the more in favor of a legally binding permission. Because without such permission, statements of a legal or factual nature may not be made in the name of another person. Clearly, the person posting in the (other person's) name of the user was intended to be legally protected. This also occurred in connection with contractual relationships. This already applies with regard to the user's contractual relationship with the defendant. The user is in a contractual relationship with the defendant arising from the use of the internet platform offered by the defendant. Within the use of this service provided by the defendant, the defendant allows the user - via an interface on its website - access to the game apps. This access is therefore also subject to the contractual agreements between the defendant and the user. The fact that the defendant, in the disputed provision, does not grant itself a right (to post) from the user, but rather from the respective game operator, is irrelevant to the existence of general terms and conditions. This is because the user can also obtain rights for third parties, especially if they have a personal interest in such a design or—from the user's perspective, as in this case—could at least have one.
90 The aforementioned general terms and conditions are also used by the defendant.
In this provision, the game operator is named as a third party before the user, who is still on the defendant's internet platform, even before the game app is launched.
91 (2) This assessment stands up to legal scrutiny. The complaints raised by the appeal are not successful. The appeal has neither demonstrated that the court of appeal proceeded on incorrect legal grounds nor demonstrated that it ignored the defendant's arguments relevant to the decision. There is no evidence of this either.
... 92 cc) The appeal also unsuccessfully challenges the appeal court's assumption that the clause in dispute disproportionately disadvantages the user, contrary to the principles of good faith and fair dealing within the meaning of
Section 307 (1) of the German Civil Code (BGB).
93 (1) The appeal court stated that the authorization provided for in the clause was non-transparent. This follows from the fact that the consumer thereby consents to the gaming operator posting its own content to the consumer's circle of friends - especially in the consumer's name - and that the consenting consumer cannot even begin to foresee the number and content of these posts. Such a move is solely in the economic interest of the defendants and the gaming operators. Given the apparent lack of transparency, this interest is also not worthy of protection.
94 Such data processing also contradicts the information obligations under data protection law and is therefore incompatible with the essential principles of the statutory provisions (Section 307 (2) No. 1 of the German Civil Code). There is a lack of any definition of clear purposes through a specific content. According to the wording of the consent required of the consumer, the gaming operator could, for example, also advertise products of other companies (such as motor vehicles or even sexually explicit products) to the consenting consumer's circle of friends – and do so in the name of the consenting consumer. It is also obvious that this undermines the minimum standards of data protection law and cannot be permissible under any data protection law – not even Irish law.
95 (2) This assessment also stands up to legal scrutiny.
Contrary to the appeal's complaint, the court of appeal did not proceed from unfounded hypotheses, but rather properly assessed the circumstances of the case in accordance with real-life experience. To the extent that the appeal asserts that the notice in dispute was neither unclear nor incomprehensible, it also does not establish any legal error by the court of appeal.
96 d) The risk of repetition required for the asserted injunctive relief is actually presumed due to the established infringement and, for the reasons already stated, is not eliminated by the cease-and-desist declaration, subject to penalty, made by the defendant during the appeal proceedings in relation to the prohibitions sought in the claims (see B II 1 d bb).
9726 I ZR 186/17 of March 27, 2025 | rewis.io
3. The plaintiff's claim for reimbursement of the flat-rate warning fee arises
from Section 12 (1) Sentence 2 of the German Unfair Competition Act (UWG) (old version). The claim for interest arises from Sections 291 and 288 (1)
Sentence 2 of the German Civil Code (BGB).
Section 98 C. Accordingly, the appeal is to be dismissed at the defendant's expense (Section 97 (1) of the Code of Civil Procedure).
Koch Löffler Schwonke
Schmaltz Odörfer
