LG Hannover - 13 O 129/21
From GDPRhub
| LG Hannover - 13 O 129/21 | |
|---|---|
 | |
| Court: | LG Hannover (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 82(1) GDPR Article 82(3) GDPR § 28a BDSG a.F. § 29 BDSG a.F. § 31 BDSG |
| Decided: | 14.02.2022 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 13 O 129/21 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | OpenJur (in German) |
| Initial Contributor: | Florian Wuttke |
The Regional Court of Hannover ordered a credit reference agency to pay a data subject €5000 in damages for failing to grant their request to erase a negative credit entry, and for storing this entry for two years. Both parties appealed the judgment and that Higher Regional Court decided on 3 November 2022 to set aside the judgement of the Regional Court of Hannover and to dismiss the damage claim (5 U 31/22). The appeal court judgement is final.
English Summary
Facts
The controller is a credit reference agency. The data subject entered into a contract with a mobile phone provider under the address of his parents. The mobile phone was used by the data subject's brother. During the term of the contract, the mobile phone provider was unable to debit an amount due and, therefore, sent debt collection letters to the registered address. However, the data subject did no longer live at his parents' address. The debt was then settled in the short term, but the mobile phone provider terminated the contract and initiated a negative entry in the controller's debt register. One year later, the data subject requested the controller to delete the negative entry, because he has never received any which the controller refused. The controller felt it was entitled to keep the entry, because the debt has not been paid initially and two debt collection letters had been sent to the parents' address. Subsequently, the data subject obtained a judgement ordering the controller to delete the entry. The controller, however, did not immediately comply with the judgement. As it turned out, the data was still processed by the controller and shared with its customers. Only three months later, after the data subject again requested deletion, the controller finally removed the entry.
The data subject then initiated new court proceedings claiming damages for the unlawful storage of its data. The controller applied for the dismissal of the claim, arguing that the negative entry was stored lawfully and the data subject did not suffer any damages.
The incident partially occurred before the GDPR came into effect. The facts of the case were therefore partly assessed on the old version of the German Data Protection Act (BDSG a.F.).
Holding
The Regional Court Hannover (Landgericht Hannover - LG Hannover) awarded €5000 in damages to the data subject according to Article 82 GDPR, since the the processing of the data by the controller violated the old German Data Protection Act and the new one. The court found that a credit reference agency may lawfully process data under the old and new version of the German Data Protection Act, if it proves that the data subject has received two debt collection letters by the creditor before the data is transferred from the creditor to the credit agency. However, the court determined that, in the case at hand, the defendant was not able to provide such proof, since the debt collection letters were sent to the parents' address and not the current address of the data subject.
Moreover, the LG Hannover held that the claimant suffered non-material damages in the sense of Article 82(1) GDPR, because the controller unlawfully disclosed the data to its customers. The court also held that under Article 82 GDPR the violation does not need to amount to a grave violation, unlike usually required in German law for the compensation of non-material damages. Furthermore, the court came to the conclusion that the defendant was responsible for the event giving rise to the damages according to Article 82(3) GDPR. It held that initially the defendant was not obliged to verify whether the data subject received two debt collection letters by the mobile phone provider, but could rely on the mobile phone provider acting in accordance with the law. However, after the data subject had informed the controller that he has never received any debt collection letters, the controller was obliged to check whether this information was true. As it never did so, the court concluded that the controller was responsible for the damages which occurred after this time.
When the LG Hannover determined the amount of damages, it took into consideration that the data was processed to calculate a credit score, which can significantly affect the professional and private life of a person, that the controller did not comply with its obligation to verify the lawfulness of the processing for two years and that the plaintiff himself contributed to the existence of the negative entries by not informing the mobile phone provider of the change of his address.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
LG Hanover, judgment of February 14, 2022 - 13 O 129/21
Source openJur 2022, 3734 Rkr: AmtlSlg:
Civil LawPrivacy Law
tenor
1
1. The defendant is sentenced to pay the plaintiff €5,000.00 plus interest at a rate of five percentage points above the
Base interest rate to be paid since April 9th, 2021.
2
2. The defendant is ordered to release the plaintiff from pre-trial legal fees of €282.15.
33. Otherwise the action is dismissed.
44. The plaintiff bears 71% of the costs of the legal dispute and the defendant bears 29%.
5
5. The judgment is provisional against security of 110% of the amount to be enforced
enforceable.
facts
6
The parties are arguing about compensation for pain and suffering due to a negative entry at the expense of the plaintiff in the credit agency
defendants.
7
The plaintiff had a relationship with Telekom Deutschland GmbH (hereinafter: Telekom) at the registration address of his parents
signed a mobile phone contract that his brother used. In November / December 2017 the due
Amounts from the contractual relationship are not debited by Telekom. The plaintiff was already residing at that time
no longer with his parents. Telekom caused a negative entry in January 2018 because of the claims
at the defendant (reference is made to Appendix K1 in the appendices for the plaintiff). As of April 2018, the
Telkom the contract. During a visit to his parents in March 2018, the plaintiff found out from a
Debt collection letter from the claim. In April 2018, the plaintiff settled the claim. In April 2019 he got in touch
to the defendant to have the negative entry deleted. The defendant rejected this in a letter dated April 12, 2019
(Reference is made to Annex K2 in the appendix volume of the plaintiff) and pointed out that the address "... Berlin"
been confirmed
8th
Postal returns, however, were not recorded. With a letter from a lawyer dated June 28, 2019, the plaintiff
request Telekom and the defendant to delete or revoke the data report (on Annexes K3 and K4
reference is made to the plaintiff's annexes). Telekom rejected this in a letter dated July 3, 2019 with a note
on the authorization to enter, since the claim was initially not paid (on Annex K5 in
Appendices to the plaintiff are referred to). She also referred to two reminder letters dated November 27, 2017 and
13.12.2017. In a letter dated July 12, 2019, the defendant refused to delete the entry (on Annex K6 in
Appendices to the plaintiff are referred to). With a statement of claim dated May 28, 2020, the plaintiff filed with the regional court
Hanover filed an action for the deletion of the negative entry, in which the acknowledgment judgment of January 25, 2021 - 13 O 133/20 -
was enacted. Since the negative entry was still saved on March 4th, 2021 (on attachment K7 in the attachment volume
Plaintiff is referred to), the plaintiff left the defendant with a letter dated March 9th, 2021 to fulfill the
request a judgment of acknowledgment. In a letter dated March 15, 2021, the defendant informed that the deletion had been made
may be; it was no longer included in information from September 7th, 2021 (reference is made to Annex K17 in the Annex volume of the plaintiff
taken). In a letter dated March 23, 2021, the plaintiff requested damages from the defendant totaling
€17,500.00, the payment of which the defendant made in a letter dated April 9, 2021 (on Annex K12 in the annex volume
Plaintiff is referred to) refused.
9The parties are in dispute as to whether and to what extent loans were not granted or not granted as a result of the entry
as they would have been granted without this entry.
10The plaintiff requests
1. to order the defendant to pay appropriate damages, the amount of which is within the obligatory,11
1. to order the defendant to pay reasonable damages, the amount of which is within the obligatory
discretion of the court, but at least EUR 1,000.00 plus interest of 5 percentage points
above the base interest rate since April 9, 2021 for the period from January 10, 2018 to April 12, 2019,
2. to order the defendant to pay reasonable damages, the amount of which is within the obligatory
discretion of the court, but at least EUR 9,500.00 plus interest of 5 percentage points
above the base interest rate since April 9, 2021 for the period from April 13, 2019 to January 25, 2021,
3. to order the defendant to pay reasonable damages, the amount of which is within the obligatory
discretion of the court, but at least EUR 7,000.00 plus interest of 5 percentage points
above the base interest rate since April 9, 2021 for the period from January 26, 2021 to March 15, 2021,
4. Condemn the defendant, the plaintiff from the remaining remainder of the accrued extrajudicial
Business fee according to §§ 13, 14 No. 2300 W RVG in the amount of 711.03 euros plus 5 percentage points above
exempt base interest rate since pendency.
12The defendant requests that
13 to dismiss the lawsuit.
14
The defendant is of the opinion that the entry was not illegal because the reminders from Telekom
sent to the plaintiff's parents and thus reached him without his knowledge. In addition, the plaintiff
no causal damage proven. After all, the defendant did not meet any until the recognition judgment
Fault, she could have assumed that Telekom's entry was lawful.
reasons
15
I
16
The admissible claim is only partially founded.
17A. The lawsuit is admissible, in particular the district court of Hanover is locally responsible according to §44 paragraph 1 BDSG.
18B. The action is to be filed in the amount of €5,000.00 (below to 1.) plus interest on arrears (below to 2.)
as well as with regard to the exemption of the plaintiff from pre-trial legal fees in the amount of €282.15
(below to 3.) justified. For the rest, the action is to be dismissed (in the following to 4.).
19In detail:
201. The plaintiff can demand damages from the defendant in the amount of €5,000.00 based on Article 82(1) GDPR.
21
a. The negative entries made by Telekom from January 10, 2018 unlawfully have the plaintiff in his
violated general personality rights.
22
One that does not differ from the provisions of §28a BDSG, which is still relevant at the time of the negative entry
(Art. 6 para. 1 letter f GDPR (in conjunction with §31 BDSG n.F.) applies, whose Art. 99 para. 2 is covered from May 25th, 2018).
Transmission of personal data constitutes a violation of the general right of personality
other right within the meaning of § 823 Para. 1 BGB enjoys protection (BGH, judgment of 07.07.1983-III ZR 159/82-, para. 14,
legal OLG Düsseldorf, judgment of 09/12/2014- 1-16 U 7/14-, para. 5, juris). According to §4 paragraph 1 BDSG old version, the collection
Processing and use of personal data is only permitted insofar as the BDSG or another legal regulation
allows or orders this or the person concerned has consented. The plaintiff did not give his consent. Because of this
is the transmission of the data from the contractual relationship between the plaintiff and Telekom to the defendant at §
28a BDSG old version. In the present case, their admissibility already fails due to the prerequisite of §28a para. 1 sentence
1 No. 4 letter a) BDSG a.F., because it cannot be determined that Telekom sent the plaintiff at least twice
warned in writing.
23The burden of explanation and proof of the admissibility of the transmission of data is borne by the transmitting party
(cf. Cologne Higher Regional Court, judgment of October 21, 2014 - 1-15 U 107/14-, para. 59, juris; Düsseldorf Higher Regional Court loc.cit., para. 5; LG
Lüneburg, judgment of July 14, 2020 - 9 O 145/19 -, paras. 31, 47) resp. in this case the defendant as the data
processing body within the meaning of Section 29 (1) sentence 1 no. 3 BDSG old version. The defendant also relies on the reminders
as a fact favorable to her - because it entitles her to include the negative entry in her credit agency - and thus contributes
also according to general principles the burden of proof (cf. Arnold in: Erman, BGB, 16th edition 2020, § 130 BGB,
paragraph 33).
To the extent that Telekom sent reminders to the plaintiff at his address that was no longer current for him (only),24 To the extent that Telekom sent reminders to the plaintiff at his address that was no longer current for him (only)
sent to his parents, it is not possible to determine whether the plaintiff received them, regardless of whether they were the parents
of the plaintiff have been received. Due to his behavior, the plaintiff does not like his new address at his
to have informed the contractual partner, to have caused the mail addressed to him and thus
the reminders have not reached either. But that doesn't change the fact that the plaintiff has no access
can be determined and is initially irrelevant to the question of the admissibility of the data processing. According to the sense and
The purpose of the requirements set out in Section 28 a (1) sentence 1 no. 4 letters a) to c) BDSG is sufficient
sending reminders; rather, access to the person concerned is required in principle in order to
to fulfill the intended warning function and thus either enable the claim to be settled or him
to enable them to raise objections to the claim (cf. BR-Drs. 548/08, p. 25 f.); is responsible
also solely to the sender proof of receipt of letters sent by him, which through him a suitable
could ensure transit procedures; that would be with regard to the consequences of a negative entry with regard to
the creditworthiness of the person concerned is also readily reasonable and the person issuing the reminder bears the risk if he does so
subject to the possibility of proof; Even prima facie evidence does not apply in principle because it
There can be multiple reasons why a letter does not reach the recipient (cf. OLG Köln, loc.cit., para. 59,
legal).
25
b. The defendant has against Art.6 Para. 1 DSGVO by not lawful data processing within the meaning of the regulation
violated because these are measured against §§ 28a Paragraph 1 No. 4 Letter a), 29 Paragraph 1 Clause 1 No. 3 BDSG old version or § 31 Paragraph 2
No. 4 letter a) BDSG new version (even if this new version no longer defines the transmission requirements,
but only requirements for the data set that is used to determine probability values
may be, the transmission requirements are thereby determined at least indirectly and in
To a certain extent updated by the legislature, cf. Kamlah in: Plath, DSGVO/BDSG, 3rd edition 2018, §31 BDSG,
49) was not lawful due to the lack of (proven) warnings from the plaintiff by Telekom.
26c. Insofar as the plaintiff's personality rights have been violated, there is no need to establish that this is
is a serious one.
27In contrast to the granting of compensation for pain and suffering according to Sections 823 (1), 249, 253 BGB, Art 1 and 2 GG, a
those of Art. 82 GG not required (cf. (BeckOK DatenschutzR/Quaas, 38th Ed. 1.11.2021, DS-GVO Art.82 Rn.
32; Gola DS-GVO/Gola/Piltz, 2nd edition 2018, DS-GVO Art. 82 para. 13; LG Hamburg, judgment of September 4th, 2020 -324 S 9/19 -,
Paragraph 34, juris; LG Lüneburg, loc.cit., para. 55, juris).
28
i.e. The defendant also acted at fault.
29 Such fault is - as the Chamber already shows in the opinion of Art. 82 (3) GDPR - also within the scope
liability according to Art. 82 GDPR is required and is initially assumed with the possibility of exculpation (cf.
OLG Stuttgart, judgment of March 31, 2021 - 9 U 34/21 -, para. 43, juris; LG Karlsruhe, judgment of August 2nd, 2019-8 O 26/19-, Rn.
15, juris; Gola DS-GVO, loc.cit., para. 9; BeckOK DatenschutzR, loc.cit., para. 17; a.A. probably: BAG, ECJ submission from
August 26, 2021 - 8 AZR 253/20 (A) -, para. 39, juris).
30 Measured against this, the defendant was initially not accused of school behavior, because the examination of the
The prerequisite for the transmission in Section 28a (1) sentence 1 no. 4 letter a) BDSG old version was initially not incumbent (cf. LG
Stuttgart Urt. May 15, 2002 - 21 O 97/01, BeckRS 2002, 31212889, beck-online). The defendant therefore did not have to do without
check any indication as to whether the plaintiff after the due date of Telekom's claim at least
had been reminded twice in writing, but could rather rely on Telekom as
transmitting body had done so.
31 However, the defendant then had reason to examine this question after the plaintiff informed her in April 2019 that
that he had not been warned, so the prerequisites for the negative entries - at least from his point of view - were not
Templates. As far as they lack of knowledge of the problem of the reminders and their access to the plaintiff because of that
up to that point in the sense of Art. 82 Para
April 2019 no longer and the fault of the defendant since then can be assumed. The defendant had from April 2019
occasion to examine the question of legality. The diligence incumbent on her would have required that and the defendant
acted at least negligently since then, as long as she did not do so.
32
e. The plaintiff also suffered non-pecuniary damage.
It can be left open as to whether, even taking into account the broad concept of damage (cf. recital 146),33It can be left open as to whether not, even taking into account the broad definition of damage (cf. recital 146).
already every breach of the GDPR leads to an obligation to compensate, because the obligation to compensate a
immaterial damage must be countered by a nameable and, in this respect, actual personal injury
(LG Hamburg, loc.cit., para. 33 f., juris). Because at least one in an unlawful disclosure of data
lying "exposure" represents such a (cf. LG Hamburg, loc.cit.; LG Karlsruhe, loc.cit., para. 19, juris; LG
Lüneburg, loc.cit., para. 55; Ehmann/Selmayr/Nemitz, DS-GVO, 2nd edition, Art. 82 para. 13).
34 The defendant measured the data associated with the negative entries by their contract partners for retrieval
ready and thereby "exposed" the plaintiff. The defendant is a protective association for
general credit protection, a warning system of the credit industry whose task it is to inform its contractual partners
provide information to protect them against losses in the credit business with natural persons
(cf. OLG Düsseldorf, judgment of February 13, 2015 - 1-16 U 41/14 -, para. 28, juris). Within this system, the
The defendant not only made the data available, according to the information from March 4th, 2021, they were also made available
repeatedly and both in the context of private inquiries and in relation to the plaintiff's activity as the owner of a
Physiotherapy practice retrieved. On whether the negative entries also meant that the plaintiff had no credit or
such was granted under different (worse) conditions than would have been granted without the entries,
however, the immaterial claim for compensation is irrelevant.
35f. The violation of the plaintiff's personality rights justifies and requires the payment of compensation for pain and suffering
in the amount of €5,000.00.
36aa. For immaterial damages according to Art. 82 GDPR, those developed within the framework of §253 BGB apply
general principles (BeckOK DatenschutzR/Quaas, loc.cit., para. 31; Gola DS-GVO, loc.cit., para. 9). Therefore can
also the contributory negligence of the person concerned analogous to § 254 BGB in the assessment of the amount of damages
be taken into account (cf. BeckOK DatenschutzR/Quaas, loc.cit., para. 28; Ehmann/Selmayr/Nemitz, loc.cit., para. 15; loc.cit.
probably Kühling/Buchner/Bergt, 3rd edition 2020, GDPR Art. 82; BAG, loc.cit.).
37bb. In the present case, the violation of the defendant justifies, taking into account all the circumstances of the present
In individual cases, compensation for pain and suffering in the amount of €5,000.00.
38(1) The data on the plaintiff's creditworthiness are sensitive data that are worthy of protection and relate both to his professional activity and to
also affect his creditworthiness in the private context. You can have a significant negative impact on the
Participate in economic transactions in these areas by denied credit or sought by the plaintiff
contracts cannot be concluded with him. That the defendant as a warning system of the credit industry with their
information and the base score calculated for this purpose and on the basis of the entries (the -
even if the algorithms for its formation are not known and the value is therefore not comprehensible - on
April 25, 2019 to 55.2% (see Annex K1), on March 4, 2021 to €69.56 (see Annex K7) and on September 7, 2021 and therefore
after deleting the negative entries amounted to 91.79%) exerts no influence on such things, one does not become serious
can accept. This influence - without it being part of an intangible claim of the concrete
determination of the material disadvantages - is also of some weight; the LG Lüneburg points this out correctly
point out that this indirectly affects fundamental rights such as freedom of occupation and general freedom of action
(LG Lüneburg, loc.cit., para. 58).
39
(2) For the assessment of the compensation for pain and suffering, the negative entries are probably short until April 2019
to be taken into account after March 4th, 2021 and thus lasted for about two years.
40
(3) They also fell in a period that was already important for economic life due to the corona pandemic
Participating was associated with major economic risks and problems, the plaintiff was therefore responsible for the consequences
particularly susceptible to negative information.
41(4) In the present case, it must also be taken into account that the defendant is initially not at fault
met, with increasing duration of the illegal situation from the first indications by the plaintiff in April 2019
about the lawsuit being filed in May 2020, her doubts about the legality of her actions had increased
have to pay. This applies in particular to the period after the acknowledgment judgment of January 25, 2021 and the
The fact that the negative entries were still saved on March 4th, 2021.
(5) Equally, it cannot be disregarded that the plaintiff made an entry leading to the negative entries,42
(5) Equally, it cannot be disregarded that the plaintiff led to the negative entries
caused himself. Because he didn't tell Telekom about his change of address, he gave her
taken the opportunity to him with their reminders on the although in terms of proof of access
risky, but at least quite common way of sending a simple letter. The behavior of
Plaintiff's knowledge of the arrears suggests that it will then immediately settle the claims
Telekom had come and the negative entries had not been launched.
43cc. After all this - as happened - a uniform compensation for pain and suffering is to be formed.
44 The calculation made by the plaintiff according to time periods is therefore not to be made. As far as one
Assessment of compensation for pain and suffering after (two) periods can then exceptionally be carried out,
if it is about the payment of capital on the one hand and a pension on the other (cf. BGH, judgment of 06/08/1976 - VI
ZR 216/74 -, juris), such a payment is otherwise out of the question, especially in the case of a payment (only) of capital
(cf. OLG Hamm, judgment of February 11, 2000 - 9 U 204/99 -, para. 17, juris; OLG Frankfurt, decision of April 14, 2020 15 W
18/20 -, paragraphs 17 -18, juris; each with further information).
45
2. The plaintiff can claim interest on arrears from April 10, 2019 on the basis of the defendant's letter of refusal dated
04/09/2019 gladly. §§ 286 Para. 2 No. 3, 288 Para. 1 BGB require, whereby according to § 187 Para. 1 BGB the
Interest does not begin to accrue until the day after default occurs (cf. Staudinger/Repgen (2019) BGB § 187, para.
5; Grünberg-Ellenberger, Civil Code, 81st edition, marginal number 1 to Section 187 with further references).
463. Finally, the plaintiff is entitled to an exemption from the pre-trial proceedings required for legal prosecution
legal fees. With an item value of €5,000.00 (the authorized part of the
claim asserted out of court (cf. BGH, judgment of 18.07.2017 -VI ZR 465/16 -, para. 7, juris; BGH,
Judgment of 12.12.2017 - VI ZR 611/16 -, para. 5, juris)), these amount to §§13 para. 1, in conjunction with Nos. 2300, 7002,
7008 VV RVG to the appropriate 1.3 business fees plus flat-rate expenses and VAT
A 0.65 business fee will be credited. Preliminary remark 3 para. 4 RVG, § 15a RVG, therefore to (€217.10 + €20.00
+ €45.05 =) €282.15.
474. Furthermore, the action is to be dismissed according to the above and because the plaintiff also requested the payment of
Litigation or default interest on the out-of-court fees owed by him to his legal representatives
Attorney's fees plaintiff cannot demand. Since he made the payment directly to his counsel
requests, he asserts a claim for exemption in this respect. However, claims for exemption do not fall under Section 288
BGB, as they establish obligations to act (Hager in: Erman, BGB, 16th ed. 2020, § 288 BGB, para. 6, with further references).
48
II.
49The brief of the same received after the end of the hearing on January 21, 2022 on February 7, 2022
Day gives no reason to reopen the hearing. § 156 ZPO.
50III.
51The decision on costs is based on Section 92 (1) ZPO, the decision on provisional enforceability
is based on § 709 sentence 1 and 2 ZPO.
