OLG Celle - 13 U 84/19
|OLG Celle - 13 U 84/19|
|Court:||OLG Celle (Germany)|
|Relevant Law:||Article 16 GDPR|
Article 82(2) GDPR
|National Case Number/Name:||13 U 84/19|
|European Case Law Identifier:||ECLI:DE:OLGCE:2022:0120.13U84.19.00|
|Appeal from:||LG Hannover|
8 O 49/19
|Original Source:||Niedersächsiches Landesjustizportal (in German)|
|Initial Contributor:||Sara Horvat|
The Higher Regional Court Celle held that a social media platform provider is not obligated under Article 16 GDPR to update a user's record of violations of the terms and conditions even if a court later determines that there were no such violations.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject is a user of the social media platform F (controller).
The controller was of the opinion that two comments posted by the data subject violated the terms and conditions ("F's Community Standards"). As a consequence, the controller deleted the two comments and restricted the abilities of the data subject's profile temporarily. It also made a note of haven taken these measures against the data subject in case of future violations.
The data subject filed a law suit against the controller. In this law suit the data subject requested, among others:
1. that the controller will be ordered to restore the two comments,
2. that the measures of the controller will be declared illegal,
3. that injunctive relief will be granted,
4. that the controller will be ordered to rectify the data so that the existence of a breach of the terms is deleted from the record and the counter recording the number of breaches is reset and
5. that damages will be awarded.
The Regional Court Hannover dismissed the claim of the data subject entirely.
The data subject appealed this decision.
Holding[edit | edit source]
The appellate court - the Higher Regional Court Celle (Oberlandesgericht Celle - OLG Celle) - amended the judgement and granted the requests 1-3, but still denied the requests for rectification (4) and damages (5).
After establishing that the data subject did not violate the terms and conditions, the court focused primarily on the application for rectification. The court concluded that the note of the controller about the deletion of the comments and the restriction of the account is not "inaccurate" data according to Article 16 GDPR, because the deletion and restriction of the account have indeed taken place. Furthermore, the court found that there is no indication that the controller actually stores a note in which it deems its measures to "have been proven lawful"[explicitly phrased this way by the court - see Comments on this]. The court further reasoned that even if the controller would have stored such a note, the data subject would still have no right to rectification under Article 16 GDPR, because the content would be a legal assessment and not a fact. The court concluded that legal assessments are opinions and opinions of private persons are, as far as they do not contain any factual elements, excluded from the scope of Article 16 GDPR because of the freedom of speech. The court then clarified that the controller's opinion would obviously have no legal effect. Only the court's ruling in the context of the application for a declaration (application 2 of the claim) has a binding legal effect on the question of the (un)lawfulness of the controller's measures.
Regarding the application for damages, the court determined that the data subject is not entitled to damages under sentence 1 of Article 82(2) GDPR because the controller's measures - regardless of their contractual permissibility - did not constitute a violation of the GDPR. The court found that the data subject consented to the processing of the data. It, eventually, reasoned that the controller's breach of contract itself (the unlawful deletion of the comments) does not make the processing of the data unlawful.
Comment[edit | edit source]
That opinions are excluded from the scope of Article 16 GDPR, in my opinion, already follows from the word "inaccurate" in the first sentence of Article 16 GDPR and does not need to be derived from the freedom of expression. Only facts can be either accurate or inaccurate, not opinions. A fact is of objective nature, something that can be proven true. An opinion is of subjective nature, something that expresses the attitude of a person towards something. The distinction between the two depends on how a third party would have understood the statement, whether they would haven take it as a statement of fact or as an expression of attitude.
The decision raises some questions. If the controller would have actually noted down that its measures "have been proven lawful" - as phrased by the court - would that not be a factual statement? The measures of the controller were indeed proven unlawful by the court. Where is the line between legal evaluation and factual statement? Can a binding court decision turn a legal evaluation into a fact for the parties involved? May the outcome of a request under Article 16 GDPR depend on the phrasing of the data? What about the right to be forgotten under Article 17 GDPR?
In my opinion, it is reasonable to assume that internal notes by the controller such as "user X violated provision Y" or "measures A, B and C are lawful because of a violation of D" are legal evaluations, and they keep this character even after a court issued a binding decision that the user did not violate the terms and conditions. The controller is free to have another opinion than the court. However, if the controller would somehow express this view in a way that gives a factual meaning to it, e.g. making a public statement that "user X violated provision Y" - without any hint to being an opinion, the user would have a right to rectification under Article 16 GDPR. I think the phrase "have been proven lawful" is a statement of fact and, therefore, must be rectified under Article 16 GDPR to "have not been proven lawful".
An interesting question, which was not raised, would have been whether the requirements of Article 17 GDPR were met in this case. The data subject primarily wanted his violations to be deleted. There could be an argument that Article 17(1)(a) GDPR is fulfilled after the court determined that the measures of the controller were unlawful. The "past violations" could not legally justify stricter measures against the data subject in case of future violations. Therefore, the storing of the past violations could no longer be necessary.
This however would then raise the question whether legal evaluations are personal data or not. The Tax Court of München recently held that legal evaluations do not constitute personal data according to Article 4(1) GDPR, only the (personal) facts underlying the evaluations do, see https://gdprhub.eu/index.php?title=FG_M%C3%BCnchen_-_15_K_118/20.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.