LfDI (Baden-Württemberg) - 21/09/2022
|LfDI - Data from the land register is not freely available for use|
|Relevant Law:||Article 6(1)(f) GDPR|
Article 14 GDPR
|National Case Number/Name:||Data from the land register is not freely available for use|
|European Case Law Identifier:||n/a|
|Original Source:||LfDI (in DE)|
The DPA of Baden-Wuerttemberg (LfDI) issued fines of €50,000 against a real estate development company and €5,000 against a surveyor for misuse of land register data in violation of Articles 6(1)(f) and 14 GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
A property owner (the data subject) received a letter from a real estate developer (the first controller) offering them a purchase price for their property. The letter did not contain any information about the origin of the data, and when asked, the controller did not disclose where they had obtained the data from.
Subsequently, the fines office at the LfDI determined that a surveyor (the second controller) had made use of their authority to inspect the electronic land register using the automated retrieval procedure, identified several hundred property owners without their knowledge and passed the corresponding information on to the first controller.
Holding[edit | edit source]
Violation of Article 6(1)(f) GDPR
The LfDI found a violation of Article 6(1) GDPR. When weighing the interests in the context of Article 6(1)(f) GDPR, it must be taken into account that there was no prior business relationship between the data subject and the first controller and that the data subjects did not have to assume that their data would be available in the land register for promotional approaches. In this context, the fact that property owners cannot object to the entry in the land register nor to the transfer of data is of particular importance since their data is collected on the basis of a statutory obligation which is not intended to serve advertising purposes.
Violation of Article 14 GDPR
Furthermore, the LfDI decided that the first controller breached Article 14 GDPR since the data subject was not provided with any information on data processing. This was based on the fact that the right to information is an essential prerequisite for data subjects to be able to assert other rights under the GDPR. The exemption under Article 14(5)(c) GDPR was not applicable since neither the body collecting the data nor the scope, purpose or duration of the data collection were apparent to the data subject when they were inspected by third parties under §12 of the Grundbuchordnung (GBO, German land register code).
The LfDI imposed fines of €50,000 on the first controller and of €5,000 on the second controller. When calculating the fines, the LfDI took into account the number of data subjects, the type of data involved, the significance of the violated provisions, and the cooperation of the responsible entities. The fines were accepted by the responsible parties and therefore became legally binding.
Comment[edit | edit source]
This summary was written based on a press release, as the official decision has not been published yet. For the same reason, the relationship between the real estate development company and surveyor as data controllers could not be clearly established. Furthemore, the press release does not make it clear whether this is a complaint procedure or an ex officio investigation by the DPA.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.
LfDI Baden-Württemberg has imposed fines for improper use of land register data Data from public registers such as the land register are also not freely available The state representative Dr. Stefan Brink: “Those responsible should be aware that public data also enjoys protection and is not freely available. The fines imposed in the present case make it clear that clandestine data processing using special access rights does not pay off. The General Data Protection Regulation also applies in the highly competitive building land market.” The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg has imposed fines of EUR 50,000 and EUR 5,000 on a property developer and a surveyor for illegal data collection and transfer and breaches of information obligations. A property owner in a new development area had received a letter from a property developer in which he was offered a purchase price for his property. The letter did not contain any information about the origin of his data, and even when asked, the addressee was not told where the developer got his data from, in particular the knowledge of his position as owner. The fine office at the State Commissioner then determined that a surveyor had made use of his authorization to inspect the electronic land register in the automated retrieval process and in two cases had identified several hundred property owners without their knowledge and passed on the relevant information to a property developer. The latter, in turn, wrote to the owners determined in this way with a purchase price offer for their properties without providing the necessary information according to Art. 14 DS-GVO, in particular without informing about the origin of the data. On the one hand, this procedure constitutes a violation of Art. 6 Para. 1 DS-GVO. When weighing up interests within the scope of Art. 6 Para. 1 Letter f DS-GVO, it must be taken into account that no prior business relationship existed and the owners did not have to assume that their data would be available in the land register for advertising purposes. The fact that property owners can neither object to the entry in the land register nor to the transmission of data is of particular importance here, rather their data is collected on the basis of a legal obligation. However, this legal obligation does not serve to address advertising, but rather to ensure legal certainty in real estate transactions. Accordingly, it is also generally recognized for the right to inspect the land register that a sole interest in acquisition does not entitle to inspect, rather concrete contract negotiations are required. In addition, there was also a violation of Art. 14 DS-GVO in that the owners were not provided with any information on data processing, even when they were contacted. However, this information is an essential prerequisite for data subjects in order to be able to assert their rights under Art. 15 et seq. DS-GVO. There was also no reason for exclusion in the present case, in particular § 12 GBO does not constitute a legal regulation within the meaning of Art. 14 Para. 5 Letter c DS-GVO, since neither the data-collecting body nor The scope, purpose or duration of the data collection can be seen. When assessing the fine, in addition to the number of people affected, the type of data affected and the importance of the violated regulations, the cooperation of the responsible bodies in the fine procedure was taken into account. The fines were accepted by those responsible and are now legally binding. For questions you can contact us on the telephone number 0711/615541-23 and by email: email@example.com Further information on data protection and freedom of information can be found on the Internet at www.baden-wuerttemberg.datenschutz.de or at www.datenschutz.de.