OLG Karlsruhe - 14 U 150/23
From GDPRhub
| OLG Karlsruhe - 14 U 150/23 | |
|---|---|
 | |
| Court: | OLG Karlsruhe (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 17(1) GDPR Article 17(3)(e) GDPR |
| Decided: | 17.07.2020 |
| Published: | 20.01.2025 |
| Parties: | |
| National Case Number/Name: | 14 U 150/23 |
| European Case Law Identifier: | ECLI:DE:OLGKARL:2025:0115.14U150.23.00 |
| Appeal from: | LG Offenburg (Germany) 3 O 31/23 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Landesrecht BW (in German) |
| Initial Contributor: | tjk |
A court decided that the continued storage of personal data cannot be based on Article 17(3)(e) GDPR if the underlying incident is already documented in legal proceedings, and if the assertion of further claims is completely unlikely.
English Summary
Facts
The controller operates a social network in Europe. The data subject has had a private account on this network since 2008. In September 2022 an unknown third party distributed child pornography - violating the controller's terms and conditions - using the data subject's account without authorisation. On 11 September 2022 the data subject's account was temporarily deactivated. The controller had not previously heard the data subject and initially did not give a reason for blocking .
Due to the deactivation, the data subject was unable to use the network's functions. The data subject contacted the controller on 28 September 2022 and requested - inter alia - to restore the user account and remove the deletion and blocking notes from the data subject's user data record. On 1 October 2022, the account was reactivated. The blocking of the account and the deletion of the posts created by third parties are still recorded in the controller's data set.
First Instance
The data subject claimed in the first instance that the deactivation of her account was unlawful but the regional court mostly rejected the action and the data subject appealed this decision requesting - inter alia - that
- It is determined that the deactivation of the data subject's profile was in breach of contract.
- The controller is ordered to correct the data subject's data stored by it so that all deletion and blocking notes are deleted from the user data record
- The controller is ordered to refrain from blocking the data subject because of the publication of contributions or from deactivating her account for this reason without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond with a subsequent new decision. Alternatively, in the event that the court considers the above application to be too far-reaching: The controller is ordered to refrain from blocking the data subject on www.xxx.com without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond if the controller does not base its measures on violations of statutory provisions.
The controller requests the appeal to be dismissed.
Holding
The court found the data subject's request for the the deletion of data stored by the controller via deletion and blocking notes that were the reason for the account deactivation from her user data record justified. However it dismissed all other requests.
Deletion
The court found, that the notes on deletions and blockings qualified as personal data under Article 4(1) GDPR, because the data allows the conclusion that, although not by the data subject herself, images containing criminally incriminating content were distributed via her member account. The court found, that the data was originally collected in order to address a possible violation of law and the terms of use. This purpose ceased to exist after it turned out that the content was not posted by the data subject herself, but by unknown third parties during a hacker attack. Therefore the controller can no longer base measures against the data subject on the data concerning the violations and it is therefore no longer necessary for the purposes for which they were collected, Article 17(1)(a) GDPR and must therefore be deleted.
The court held that Article 17(3)(e) GDPR applies not when merely an abstract possibility of a future lawsuits exists, because accepting such a theoretical risk as an exception to data protection law would not be compatible with the GDPR. Additionally, the court stated the incident in question cannot be used as a basis for justifying future sanctions against the data subject from the outset, since the incident in question was based on a hacker attack that indisputably did not fall within the data subject's area of responsibility.
The court found, that the controller also does not need the data either to defend itself in the present proceedings as the relevant facts are undisputed and have been documented in the legal and court files for the controller's fulfillment of contractual obligations according to Article 6(1)(b) GDPR.
Injunction
The court dismissed the data subject's claims for injunctive relief because the controller was, on the one hand, fully entitled to remove the post and temporarily block the account, which is why a contractual claim for injunctive relief under § 280(1) German Civil Code (Bürgerliches Gesetzbuch - BGB) (in conjunction with § 1004 BGB) is ruled out.
The court found, that by deactivating the data subject's account (temporarily) without hearing it, the controller did not violate its obligations under the user agreement. According to the terms of use regulating exceptional termination largely corresponding to the statutory regulation in § 314 BGB, exceptional termination for good cause is expressly provided for. As a less intrusive measure to termination, these terms easily enable the controller to (temporarily) deactivate the affected user account for verification purposes if there is a suspicion that there is an important reason such as the distribution of child pornography. Thus, the controller was initially entitled to temporarily deactivate the user account immediately.
Comment
In this case, the court discussed the implications of the Federal Court of Justice's (Bundesgerichtshof - BGH) judgement providing a right to be heard before account terminations (III ZR 179/20) by social networks. The BGH held, that only in narrowly defined exceptional cases, which are to be specified in more detail in the general terms and conditions, a hearing before imposing a temporary block may be dispensable, it acknowledges that there may be cases in which a prior hearing is unreasonable for the controller. The OLG Karlsruhe now held, that contrary to the data subject's opinion, it cannot be assumed that such blockings without prior hearing are only permissible if groups of cases have been effectively agreed in advance in the controller's terms of use.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Court: OLG Karlsruhe 14th Civil Senate Decision date: January 15, 2025 File number: 14 U 150/23 ECLI: ECLI:DE:OLGKARL:2025:0115.14U150.23.00 Document type: Judgment Source: Standards: Section 280 Paragraph 1 BGB, Section 1004 BGB, Art. 17 Paragraph 1 EUV 2016/679, Art. 17 Paragraph 3 EUV 2016/679 Guiding principle 1. If the reasons that led to the collection and retention of personal data by the operator of an internet platform after the deletion of content from a user account or the temporary blocking of this user account no longer apply, the continued processing of the data in the form of storage cannot be based on the exception provision of Art. 17 Paragraph 3 Letter e of GDPR be supported if the underlying incident is already the subject of a legal dispute and the assertion of further claims is theoretically possible but entirely unlikely. 2. If there is reasonable suspicion that a user of an Internet platform has uploaded child pornography material, immediate blocking or deactivation of the user account for verification purposes without prior hearing is permissible in any case if the terms of use allow immediate termination for good cause. Proceedings previous LG Oldenburg (Oldenburg), August 11, 2023, 3 O 31/23, judgment Tenor I. On the plaintiff's appeal, the judgment of the Offenburg Regional Court of August 11, 2023, case number 3 O 31/23, is partially amended and reformulated as follows: 1. The defendant is ordered to correct the plaintiff's data stored by it so that all deletion and/or blocking notes that were the reason for the account deactivation of the plaintiff's profile (registration email: ...@me.com) on www.xxx.com on September 9, 2022 are deleted from the user data record. 2. The rest of the action is dismissed. II. The plaintiff's further appeal is dismissed. III. The plaintiff shall bear 3/4 of the costs of the legal dispute in both instances and the defendant 1/4. IV. The judgment is provisionally enforceable, with regard to I. Item 1 against security in the amount of €1,000, and in the remaining cases against security in the amount of 110% of the respective amount to be enforced. - Page 1 of 15 - Decision The value in dispute for the appeal proceedings is set at €5,146.20. Reasons I. 1 The parties are disputing claims due to the temporary deactivation of the plaintiff's A account. 2 The defendant operates the social network A in Europe. The plaintiff has had a private account on this network since 2008. Clause 3.2 of the Terms of Use applicable between the parties (Appendix B 1) states: 3 “[…] 1. You may not use our products to do or share anything that: 4 violates these Terms of Use, the Community Standards or any other terms and guidelines that apply to your use of our products. 5 is unlawful, misleading, discriminatory or fraudulent (or assists another person to use our products in this way). 6 […] 7 violates or infringes the rights of another person […] 8 […] 9 We may remove or block content that violates these provisions. 10 If we remove content you have posted because it violates the Terms of Use or the Community Standards, we will notify you immediately and also tell you the reason for this action. If you do not agree with our decision, you can request a review. If you request a review, you will be notified whether we will confirm the decision or restore or unblock the content. 11 If you violate these terms, without prejudice to our right of termination under Section 4.2, we may also restrict your use of certain features of A for a limited period of time. This includes, among other things, creating content such as posting or commenting, using A-L. or creating an A-Page. The nature and extent of such restrictions will depend on the severity of your violation and the number and nature of previous violations. We will notify you of this and the reason for the measure. If you do not agree with the intended restriction, you can request a review before the restriction takes effect. If you request a review, you will receive notification of our final decision. - Page 2 of 15 - 12 Notification of the removal or blocking of content or of the restriction of the use of an account, including details of the reason, the possibility of requesting a review and, if applicable, the nature and duration of the restriction, will not be provided if and to the extent that we are prohibited from doing so for legal reasons. It will also not be provided if and to the extent that the notification would be inappropriate taking into account the interests of both parties. 13 […]" 14 Under "Sexual abuse, abuse and nudity of children" the Community Standards (Appendix B 2) regulate: 15 "Basic idea of this policy 16 We do not allow any content or activities in which or through which children are sexually abused or endangered. […]" 17 The following is a list of specific content that is prohibited. In particular, content depicting the nudity of children is prohibited. In September 2022, 18 unknown third parties distributed child pornography using the plaintiff's account without authorization. On September 9, 2022, the defendant placed the account in a so-called "checkpoint" and on September 11, 2022, it was temporarily deactivated. The defendant had not previously heard the plaintiff. The defendant did not initially give a reason for blocking the account. Due to the deactivation, the plaintiff was unable to use the network's functions and, in particular, was unable to interact with other users. 19 The plaintiff contacted the defendant with a letter from her lawyer dated September 28, 2022 (Exhibit K1) and requested that she restore the user account, save the user account and all account-specific data/content, submit a cease-and-desist declaration regarding a permanent deletion or deactivation of the account, remove the deletion and blocking notes from the plaintiff's user data record and submit a cease-and-desist declaration with a penalty clause regarding further account blocking/deactivation. 20 On October 1, 2022, the account was reactivated, which was communicated to the plaintiff by email dated October 11, 2022. The plaintiff's "violation counter", which the defendant uses to count violations of the terms of use, no longer contains the disputed incidents, but the blocking of the account and the deletion of the posts created by third parties are still recorded in the defendant's data set. 21 The plaintiff claimed in the first instance that she had initially tried unsuccessfully to contact the defendant by clicking on the objection button, verifying the cell phone number, uploading the ID card and via B in order to persuade the defendant to restore the user account. The plaintiff is of the opinion that the deactivation of her A account was unlawful. The defendant should have heard her before deactivating it and may not carry out any blocking without a prior hearing in the future. Due to the illegality, the defendant was obliged to lift this. Since a reversal for the past is not possible, the plaintiff has a right to a declaration that the blocking of her profile was unlawful. It is not necessary to file a claim for performance to remove the blocking note from the data set as a priority. In addition, the plaintiff has an interest in a declaratory action for her rehabilitation and her right to effective legal protection. She has a contractual claim and a claim under the GDPR to remove the deletion and blocking notes. In addition, the defendant must refrain from blocking or deactivating the plaintiff's account without a prior hearing. 22 In the first instance, the defendant took the view that the application for a declaratory judgment regarding the breach of contract of the deactivation of the plaintiff's profile was inadmissible, since the determination of the breach of contract was subsidiary to the restoration. In addition, this application was unfounded, since the defendant was contractually entitled to temporarily block the plaintiff's account. The application for the deletion of all deletion and blocking notes is too vague, as it does not make it clear which deletion and blocking notes are to be corrected by the defendant. The application for the cessation of future account blocking/deactivation is too broad, as the application for an injunction - even in its alternative form - also covers conduct to which the defendant is entitled. In addition, the injunction claims sought by the plaintiff are ultimately inadmissible covert claims for information in the event of future blocking, which are only permissible under the restrictive conditions of Section 259 of the Code of Civil Procedure. Finally, the plaintiff's statement regarding the information on the deletion of the posts is too unsubstantiated to justify a corresponding claim, but in any case is satisfied by the statement of reasons. 23 The regional court has rejected the following points: The action aimed at establishing that the account blocking was in breach of contract, deletion of deletion and blocking notes, refraining from future account blocking/deactivation and - after a unilateral declaration of settlement at the hearing on July 18, 2023 - establishing that the initially asserted claim for information on the reason for the deletion of eleven posts had been settled was dismissed in its entirety. For the details of the reasoning, reference is made to the contested judgment. 24 The plaintiff's appeal is directed against this, with which it continues to pursue the claims it had already asserted in the first instance. In support of this, it refers to the special features of the present case, namely the fact that the deleted contributions were not posted by the plaintiff, but by third parties. The terms of use and community standards applicable to the relationship between the contracting parties at the relevant time are also non-transparent and do not satisfy the hearing requirement; they also do not satisfy the requirements for the effectiveness of a removal and blocking reservation according to the case law of the highest courts. It is not clear to a user when or in which exceptional cases the defendant should be entitled to refrain from (prior) hearing the user with the opportunity to respond and subsequently issue a new decision. In any case, the defendant continues its illegal deletion and blocking practice unchanged to this day and does not consult its users immediately after a post has been deleted and before a block is imposed, with the opportunity to respond and then issue a new decision. Although older deletion and blocking notices are no longer of any use to the defendant, they are not deleted from the user data set. All post deletions and blockings made by the defendant in the past - whether based on the old or the new removal and blocking reservation - are illegal due to the lack of an effective legal basis. A complete and permanent account deactivation without prior consultation with the user clearly represents a breach of contract on the part of the defendant and is clearly illegal. The defendant has never claimed a violation of legal provisions. It is not possible to remedy the defendant's breach of contract through a subsequent hearing. Contrary to the opinion of the regional court, the application aimed at establishing the illegality of the blocking is permissible; the claim for performance cannot be assumed to take precedence. A right to deletion follows from Art. 17 GDPR and - contractually - from Sections 280 Para. 1 and 249 Para. 1 of the German Civil Code. The user agreement concluded between the parties gives rise to a claim for injunctive relief with regard to a blocking or account deactivation via Section 241 Para. 2 of the German Civil Code in conjunction with Section 1004 Para. 1 of the German Civil Code, unless the defendant informs in advance of the intended functional restriction (in particular blocking/account deactivation) and first grants the opportunity to respond with a subsequent new decision. In the present case, a hearing should have taken place in any case in accordance with the case law of the Federal Court of Justice. To the extent that the requirement for a hearing can be waived in narrowly defined exceptional cases to be specified in the general terms and conditions, this is not an option because the defendant's general terms and conditions do not contain such provisions. 25 The plaintiff requests: 26 1. It is determined that the deactivation of the plaintiff's profile (registration email: ...@me.com) on www.xxx.com on September 9, 2022 was in breach of contract. 27 2. The defendant is ordered to correct the plaintiff's data stored by it so that all deletion and blocking notes are deleted from the user data record. 28 Alternatively, in the event that the court considers the above application to be too extensive: 29 The defendant is ordered to correct the plaintiff's data stored by it so that all deletion and/or blocking notes that were the reason for the account deactivation in accordance with point 1 are deleted from the user data set. 30 3. The defendant is ordered to refrain from blocking the plaintiff on www.xxx.com because of the publication of contributions (in particular, from withholding the use of the functions of www.xxx.com such as posting contributions, commenting on other people's contributions and using the messaging system) or from deactivating her account for this reason without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond with a subsequent new decision. - Page 5 of 15 - 31 In the event of a violation, the plaintiff is threatened with a fine of up to €250,000, alternatively a fine, or fine detention, the fine detention is to be carried out on the board members. 32 Alternatively, in the event that the court considers the above application to be too far-reaching: 33 The defendant is ordered to refrain from blocking the plaintiff on www.xxx.com for publishing contributions (in particular, from withholding the use of the functions of www.xxx.com such as posting contributions, commenting on other people's contributions and using the messaging system) or from deactivating her account for this reason, without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond with a subsequent new decision if the defendant does not base its measures on the plaintiff's violations of statutory provisions. 34 In the event of a violation, the plaintiff is threatened with a fine of up to €250,000, alternatively detention, or detention, the detention is to be carried out on the board members. 35 4. It is determined that the legal dispute, insofar as the plaintiff has requested that the defendant be ordered to provide the plaintiff with information about the reason for the deletion of eleven posts dated September 9, 2022, has been settled. 36 5. The defendant is ordered to indemnify the plaintiff from legal fees for the out-of-court work against the defendant in the amount of €740.06 by paying them to the law firm ... 37 The defendant requests that the appeal be dismissed. 39 The defendant points out that the plaintiff's statements were largely based on incorrect facts, in particular insofar as a complete and permanent account deactivation was repeatedly claimed. In fact, the user account in question was only temporarily deactivated for a very short period of time in September 2022. The appeal is already inadmissible because there is no proper justification for the appeal within the meaning of Section 520 Paragraph 3 Sentence 1 of the Code of Civil Procedure. The appeal is also unfounded. Insofar as the plaintiff believes that the regional court does not attach any importance to the fact that the content does not come from the plaintiff herself but from unknown third parties, she fails to recognize that objectively a disruption emanated from the plaintiff's user account that justified immediate deactivation. The special public interest in effectively combating the publication and distribution of child pornography content is the argument for this. The application for a declaratory judgment asserted in claim number 1 is already inadmissible. The claim for data correction pursued in claim number 2 is ruled out under all conceivable aspects (Articles 16, 17 GDPR). In any case, the regional court correctly rejected the blanket injunction asserted in claim number 3 as unfounded. With regard to time-limited restrictions on use, the Federal Court of Justice expressly stated that a prior hearing is not necessary in every case. Finally, the regional court correctly rejected the claim asserted in claim number 4 for a declaration that the right to information has been settled; there is no apparent legal basis for the information requested. 40 For further details, reference is made to the minutes of the oral hearing of 18.12.2024 and the written submissions of the parties and their attachments. II. 41 The admissible appeal is justified with regard to the appeal application number 2, but otherwise unfounded. 42 1. The German courts have international jurisdiction (see a). German substantive law is applicable (see b). 43 a) The international jurisdiction of the German courts, which must be examined ex officio, follows from Art. 17 para. 1 lit. c, para. 2 in conjunction with Art. 18 para. 1 alt. 2 of Regulation (EU) No. 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgements in civil and commercial cases (so-called Brussels Ia Regulation). According to this, the plaintiff, as a consumer who uses the defendant's platform privately and not professionally or commercially, can bring an action against the defendant, who has also focused her commercial activity on Germany, in the court of her place of residence (see also BGH, judgment of July 29, 2021 - III ZR 179/20, para. 24, juris). 44 b) The claims asserted are to be assessed under German law. Due to the choice of law clause in No. 4.4 of the defendant's terms of use (Annex I, B 1), the user agreement concluded between the parties is subject to German law in accordance with Articles 3 (1) and 6 (2) of Regulation (EC) No. 593/2008 of the European Parliament and of the Council of June 17, 2008 on the law applicable to contractual obligations (so-called Rome I Regulation). Its applicability would also arise from Article 6(1)(b) of the Rome I Regulation even without the parties choosing a law, because a consumer contract is in place (see also BGH, loc. cit., para. 26, juris). 45 2. The action seeking a declaration that the deactivation of the plaintiff's profile on September 9, 2022 was in breach of contract is already inadmissible (see a) and would also be unfounded (see b). 46 a) To the extent that the plaintiff seeks a declaration that the deactivation of the plaintiff's profile on September 9, 2022 was in breach of contract, the action is already inadmissible, as the regional court correctly pointed out. In this respect, there is a lack of both a legal relationship capable of being established (see aa) and – assuming a legal relationship capable of being established – the interest in establishing the facts required under Section 256 para. 1 of the Code of Civil Procedure (see bb).47 aa) The plaintiff is not seeking to establish a current legal relationship within the meaning of Section 256 of the Code of Civil Procedure. 48 The filing of both a general declaratory action (Section 256 Paragraph 1 of the Code of Civil Procedure) and an interim declaratory action (Section 256 Paragraph 2 of the Code of Civil Procedure) is only permissible if they concern the existence or non-existence of a legal relationship. A legal relationship is formed by the legal relationships between persons and persons or between things arising from a specific factual situation. Individual preliminary questions or elements of a legal relationship, the existence of which alone does not lead to any specific legal consequences, do not constitute a legal relationship. The possible illegality of the account blocking in question does not in itself result in any specific legal consequences, but merely forms an element of any claims linked to it; because the question of the illegality of an act is only directed at the legal assessment of a process and thus constitutes a preliminary question of the legal consequences that can follow the process. A corresponding application of the procedural provisions on the continuation declaratory action under Section 113 Paragraph 1 Sentence 4 of the Administrative Court Act is not possible from the outset due to the lack of an unintentional regulatory gap in civil proceedings (on the whole with far-reaching reference OLG Frankfurt, judgment of November 14, 2024 - 16 U 52/23, para. 76 ff., juris). 49 bb) Regardless of this, the further requirements of Section 256 Paragraphs 1 and 2 of the Code of Civil Procedure were also not met. 50 The plaintiff could also pursue her legal protection objective through an action for performance – which takes priority over the declaratory action (see only BGH, judgment of May 8, 2015 – V ZR 62/14, para. 35, juris) – by requesting the restoration of the deleted posts and – which she has also done – the cessation of further account blocking (the prevailing opinion, see only OLG Karlsruhe, judgment of May 26, 2023 – 10 U 24/22, para. 216 ff., juris with further references). 51 The application for a declaratory action would also not be admissible under Section 256 (2) of the Code of Civil Procedure. According to this provision, there is no room for an interim declaratory action if the legal relationship in question does not have the necessary precedence for other legal disputes. The plaintiff's possible claims in connection with the account blocking and post deletions in dispute could, on the one hand - in view of the facts of the case, only theoretically - be decided within the framework of the priority claim for performance - aimed at restoring the deleted posts - and, on the other hand, will be decided within the framework of the asserted claim for injunctive relief; there is no evidence of any further "precedence" (cf. OLG Karlsruhe, judgment of May 26, 2023 - 10 U 24/22, para. 218, juris; OLG Dresden, decision of February 13, 2024 - 4 U 1325/23, para. 9, juris). 52 To the extent that the plaintiff bases its contrary opinion on a decision of the Schleswig Higher Regional Court (judgment of November 8, 2024 - 1 U 70/22, para. 70 ff., juris), which justified precedence with the possibility of partial judgments on the several claims pursued independently, this is not convincing in the present constellation of a legal dispute ready for decision with regard to all claims, since the requirements for issuing a partial judgment in accordance with Section 301 of the Code of Civil Procedure are clearly already lacking. 53 b) In any case, the application for a declaratory judgment would also be unfounded, since the temporary deactivation of the plaintiff's profile from September 9, 2022 to October 1, 2022 was not in breach of contract (see below 4.). 54 3. The main application number 2, which is aimed at deleting all deletion and blocking notes from the plaintiff's user data set, is inadmissible (see a), but the more specific auxiliary application is justified (see b). - Page 8 of 15 - 55 a) Insofar as the plaintiff requests the deletion of all deletion and blocking notes from the user data set with application number 2, the application is inadmissible due to a lack of specificity (Section 253 Paragraph 2 No. 2 ZPO). If the individual notes are not specified, in the event of a conviction, the scope of the legal force with regard to the obligation to delete would not be sufficiently defined and enforcement would not be possible (OLG Frankfurt, judgment of November 14, 2024 - 16 U 52/23, para. 56, juris). 56 b) Insofar as, however, she alternatively requests the deletion of data stored by the defendant via deletion and blocking notes that were the reason for the account deactivation from her user data record, the action is justified. A claim to deletion follows from Art. 17 Paragraph 1 Letter a of GDPR. 57 According to this, the data subject has the right, within the framework of the so-called "right to be forgotten", to demand that the controller delete personal data concerning her immediately if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed. 58 aa) The defendant's notes on the deletions and blockings that have taken place in relation to the plaintiff's account are personal data within the meaning of Art. 4 No. 1 GDPR. According to this, personal data is information that relates to an identified or identifiable natural person. Data can refer directly or indirectly to the data subject. Indirect personal references are made to information that has no direct significance for a data subject, but from which information about such a person can be derived (Spindler/Schuster/Spindler/Dalby, 4th edition 2019, GDPR, Art. 4, para. 6). 59 In the present case, there is a reference to the plaintiff because the data recorded by the defendant allows the conclusion that, although not by the plaintiff herself, images containing criminally incriminating content were distributed via her member account. 60 bb) The data are no longer necessary for the purposes for which they were collected, Art. 17, paragraph 1, letter a, GDPR. 61 The data was originally collected after an alleged violation by the plaintiff of the terms of use, community standards and/or criminal/legal provisions in order to check, document and, if necessary, to base further measures on a possible violation, such as the temporary or permanent blocking of the account and, if necessary, termination of the contractual relationship. This purpose ceased to exist after it turned out that the content was not posted by the plaintiff herself, but by unknown third parties in the course of a hacker attack. Since - which is undisputed between the parties - the defendant can no longer and does not want to base contractual measures on the violations that have occurred, it can be assumed that the purpose has ceased to exist, since the data is out of date due to actual developments (Paal/Pauly/Paal, 3rd ed. 2021, GDPR, Art. 17 para. 23). 62 cc) The defendant, who is obliged to provide information and evidence in this regard, cannot claim that the continued processing of the data in the form of storage is now necessary for a different purpose, in particular with regard to Art. 17 Paragraph 3 Letter e of GDPR. According to this, a right to erasure should not exist even if the processing of the personal data is necessary for the assertion, exercise or defense of legal claims. The provision serves to ensure that legal enforcement, but also legal defense, is not restricted by the other side hindering this legal enforcement or defense by asserting claims for erasure. The opposing party should not be able to destroy evidence or facts justifying the claim through claims for erasure. How likely a legal dispute must be in order to justify this exception is controversial. In some cases it is pointed out that the requirements for such a probability should not be set "too high", since in some circumstances not only rational aspects could play a role in such a decision (Kamlah in: Plath, DSGVO/BDSG/TTDSG, 4th edition 2023, Art. 17 EUV 2016/679, para. 20, juris). In some cases a "sufficient probability" that disputes will arise is required (Holthaus in: Schaffland/Wiltfang, Datenschutz-Grundverordnung (DS-GVO)/Bundesdatenschutzgesetz (BDSG), 12th supplementary delivery 2024, Art. 17 EUV 2016/679, para. 51, juris). Regardless of the specific requirements in this regard, there is agreement that the merely abstract possibility of possible future lawsuits cannot justify an invocation of Art. 17 para. 3 lit. e GDPR (Paal/Pauly/Paal, 3rd ed. 2021, GDPR, Art. 17 para. 46 with further references). 63 (1) To the extent that the defendant argues that it is absolutely necessary to retain the data for temporary deactivation from 9 September 2022 in order to defend itself in the present proceedings, because the defendant would otherwise no longer be able to verify or falsify the claims made against it and the underlying measures against the plaintiff on the basis of its own records, this is at least not comprehensible for the present constellation (as here OLG Frankfurt, judgment of 14 November 2024 - 16 U 52/23, para. 60 ff., in particular para. 70, juris; different in a different case constellation OLG Karlsruhe, judgment of 26 May 2023 - 10 U 24/22, para. 245 f., juris). In this case, it is simply a matter of the information held in the plaintiff's data set that incriminating content was posted by third parties via the plaintiff's account, which led to the deletion of this content and the temporary blocking of the account. The process - which is also undisputed between the parties - has since been documented in the legal and court files, since the process is the subject of the present legal dispute under a number of aspects - as the application already clearly shows. The defendant has neither explained that further information is stored in the user data set that the defendant needs for legal defense, nor is it clear what information this should be. The Senate is unable to see to what extent the defendant's position in the ongoing legal dispute could be impaired if this information is deleted from the plaintiff's data set. 64 (2) To the extent that the defendant's legal representative expressed the opinion at the oral hearing on December 18, 2024 that the continued retention of the "primary source" was also necessary in view of possible future lawsuits against the defendant against the background of the statute of limitations not yet having expired and the contractual relationship still ongoing, this also does not hold water. 65 Since the plaintiff has extensively pursued potential claims in the present proceedings, there is no fear of a further lawsuit due to the underlying incident. It could still sue for compensation for pain and suffering or material damages, since it has not yet filed such claims. However, this is a completely unlikely scenario for several reasons. The fact that the plaintiff has not yet done so speaks against this. In addition, according to the case law of the highest and higher courts, such a lawsuit would have no prospect of success in a situation such as the present one, which is probably also the reason why the plaintiff, who is represented by a lawyer who specializes in cases such as the present one, has not yet asserted any claims for damages. The defendant did not substantiate its statements in this regard in the written submission of December 30, 2024, but rather asserted in a very abstract way the possibility of a further lawsuit due to the incident in dispute. Regardless of what degree of probability one requires for a (here: further) lawsuit within the statute of limitations, the prerequisites are not met in the present case if the criterion of "sufficient probability" is to have any significance. In the opinion of the Senate, to regard such a theoretical risk as sufficient and to base the application of an exception to data protection law on it would not be compatible with the assessments of the GDPR (similar to OLG Frankfurt, judgment of November 14, 2024 - 16 U 52/23, para. 60 ff., 70, juris, where the right to data correction was also affirmed with regard to an incident despite the statute of limitations not yet having expired). 66 Finally, insofar as the defendant is referring to the ongoing contractual relationship and thus has in mind possible future legal violations by the plaintiff - it must be borne in mind that the incident in question cannot be used as a basis for justifying future sanctions against the plaintiff from the outset, since the incident in question was based on a hacker attack that indisputably did not fall within the plaintiff's area of responsibility. 67 d) There is also no recognizable connection to the defendant's fulfillment of contractual obligations, as required by Art. 6 Paragraph 1(b) GDPR, which is why the continued retention of the data cannot be justified on this basis either. 68 4. To the extent that the plaintiff, in application number 3, demands that the plaintiff be blocked in the future due to the publication of posts or that her account be deactivated for this reason, without informing her in advance of the intended blocking/account deactivation and granting her the opportunity to respond with a subsequent new decision, alternatively at least if the defendant does not base its measures on the plaintiff's violations of statutory provisions, the action is unfounded. This is because the defendant was, on the one hand, fully entitled to remove the post and temporarily block the account due to the child pornography images published via the plaintiff's account, which is why a contractual claim for injunctive relief under Section 280 Paragraph 1 of the German Civil Code (in conjunction with Section 1004 of the German Civil Code) is ruled out (see a). Irrespective of this, a claim for injunctive relief in the comprehensive scope sought by the plaintiff does not exist anyway (see b). 69 a) A contractual claim for injunctive relief - which is conceivable in principle (cf. BGH, judgment of July 29, 2021 - III ZR 179/20, para. 100, juris) - is ruled out. Because the defendant was entitled not only to delete the incriminating content but also to temporarily block the account due to the criminal content of the posts in question. According to the findings of the regional court, there is no dispute between the parties that the content in dispute was child pornography and thus criminally relevant content (cf. Section 184b of the German Criminal Code). - Page 11 of 15 - 70 According to Sections 10 Sentence 1 No. 2 TMG, 4 Paragraph 1 No. 2 i. In conjunction with Section 3 Paragraph 1 Sentence 1, Paragraph 2 Sentence 1 Nos. 2 and 3 NetzDG (in the version applicable at the time of the temporary account blocking), the defendant was required, regardless of the content of its terms of use, to take immediate action to remove or block criminal content in its social network as soon as it became aware of facts or circumstances from which the illegality of the posts became obvious (BGH, judgment of July 29, 2021 - III ZR 179/20, para. 98, juris). 71 In the case of such content, a platform operator such as the defendant must have the opportunity to remove the content effectively and sustainably, which in individual cases may also require the temporary immediate blocking of a user account - which is more drastic than deleting a post. It should first be borne in mind that this was not a final and permanent deactivation of the plaintiff's account. The transfer of the user account to a so-called checkpoint status on September 9, 2022 was only for verification purposes; accordingly, the plaintiff's user account was reactivated on October 1, 2022 after it became clear that it was not the plaintiff but unknown third parties who were responsible for uploading the child pornography content. By transferring the user account to checkpoint status and deactivating it (temporarily) without hearing the plaintiff, the defendant did not violate its obligations under the user agreement. According to section 4.2 of the terms of use, which regulates the right to terminate for good cause and largely corresponds to the statutory regulation in Section 314 of the German Civil Code, termination for good cause is expressly provided for. As a disadvantage to termination, this regulation easily gives the defendant the right to (temporarily) deactivate the affected user account for verification purposes if there is a suspicion that there is an important reason. The fact that the distribution of child pornography constitutes an "important reason" within the meaning of the terms of use and the law does not require any further elaboration in view of the legal interests in question. The defendant was initially entitled to assume that the plaintiff, as the owner of the user account, had breached her duty and to temporarily deactivate the user account immediately, i.e. without first hearing the plaintiff. This is because Section 314 Paragraph 2 Sentence 2 of the German Civil Code and the corresponding Section 4.2 Paragraph 3 Sentence 2 of the terms of use state that immediate termination can be justified if "after weighing up the interests of both parties, special circumstances justify immediate termination". Such a procedure may be necessary – not least for preventive reasons – in the case of particularly serious breaches of contract, such as a violation of criminal law provisions relating to so-called CEI content (so-called “child exploitative imagery”), in order to prevent the possible posting of further child pornographic content (see in detail OLG Frankfurt a.M., judgment of October 10, 2024 – 16 U 29/23, submitted as an appendix to the defendant’s written submission of November 26, 2024). 72 The case law of the Federal Court of Justice does not contradict this. When the Federal Court of Justice states that in narrowly defined exceptional cases, which are to be specified in more detail in the general terms and conditions, a hearing before imposing a temporary block may be dispensable (BGH, judgment of July 29, 2021 - III ZR 179/20, para. 87, juris), it acknowledges that there may be cases in which a prior hearing is unreasonable for the defendant. Contrary to the plaintiff's opinion, it cannot be assumed that such blocks without prior hearing are always only permissible if conceivable groups of cases have been effectively agreed in advance in the defendant's terms of use. Such an understanding of the highest court's case law appears to be too narrow for (temporary) blocks due to the posting of child pornography material for the reasons set out above; In particular, the wording of the Federal Court of Justice (“... exceptional cases to be specified in more detail in the general terms and conditions”) does not in any way force such an understanding, which would exclude the more detailed definition of such exceptional cases by means of vague legal terms. The fact that the Federal Court of Justice also assumes that different review standards apply to posts with criminal content can be seen from the fact that it deals with these in a separate review point of its judgment (cf. BGH, judgment of July 29, 2021 - III ZR 179/20, para. 98, juris). 73 If there is a suspicion - as in the present case - that a user has uploaded child pornography material, according to the opinion expressed here, an immediate blocking or deactivation of the user account without a hearing is possible after all (expressly as here OLG Frankfurt a.M., judgment of October 10, 2024 - 16 U 29/23, loc. cit.; OLG Munich, judgment of April 12, 2022 - 18 U 6473/20, para. 48 ff., juris); in the absence of a breach of contract, a contractual claim for injunctive relief is therefore not an option. 74 b) Regardless of the legality of the specific, temporary account deactivation, the plaintiff is not entitled to such a broad, general claim for injunctive relief under the user contract concluded between the parties - or otherwise. According to the case law of the Federal Court of Justice, before an account is blocked, it is only generally necessary for the user to be heard by the defendant; as already explained, this is not necessary in exceptional cases. Against this background, a claim for injunctive relief pursued with the main application number 3 in the comprehensive scope sought by the plaintiff does not exist, because this would require that a hearing would be essential in every case without exception before each block (OLG Karlsruhe, judgment of May 26, 2023 - 10 U 24/22, para. 262, juris, with further references; OLG Munich, judgment of April 12, 2022 - 18 U 6473/20, para. 52, juris). But even the – limited – alternative application in paragraph 3 still goes too far, since the question of whether a hearing can be dispensed with in exceptional cases is always a question of the individual case (Higher Regional Court of Munich, loc. cit., para. 52, juris). 75 5. The application for a declaration that the legal dispute has been settled, insofar as the plaintiff had requested that the defendant be ordered to provide her with information about the reason for the deletion of eleven posts dated September 9, 2022, is in any case unfounded. 76 According to Art. 15 (1) GDPR, a data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed. Since the incriminated content can no longer be accessed via the plaintiff's user account because it has been deleted, no personal data will be processed in this respect; this was already the case at the time when the plaintiff first asserted the right to information. A right to information about the reason for a deletion that occurred in the past cannot be inferred from Art. 15 GDPR. The terms of use also do not contain such a right to information, as the regional court correctly pointed out. - Page 13 of 15 - 77 6. The plaintiff is not entitled to reimbursement of pre-trial legal costs. 78 Such a claim has not been sufficiently substantiated. To the extent that the plaintiff requests to be exempted from legal costs for the out-of-court work of her legal representatives against the defendant in the amount of €740.06, it is unclear which claims the application refers to. The legal representatives also asserted a claim out of court in a letter dated September 28, 2022 (Appendix I, K 1) that was later no longer the subject of the legal proceedings (claim to restore the user account). After out-of-court legal fees of €1,501.19 had been demanded from an object value of €30,000, without the calculation of the object value being explained in more detail with regard to the individual claims pursued, the plaintiff is now claiming pre-trial legal costs of only €740.06, although at no point is it explained how the plaintiff arrived at this amount and, in particular, to which claims pursued out-of-court this relates. The grounds of appeal dated October 25, 2023 (there p. 71 = AS II 79) indicate that application number 5 is not only to be understood as a secondary claim, but also includes the out-of-court effort to restore the user account and thus another main claim; However, this is contradicted by the fact that the plaintiff did not take the out-of-court legal costs into account in the amount in dispute presented in detail in the first instance, and thus treated them as a mere secondary claim. What the plaintiff wants to cover with the amount demanded of (only) €740.06 for the out-of-court work of her legal representatives is completely unclear in view of these contradictions. 79 Irrespective of this - which is no longer relevant - at the time the plaintiff's legal representatives were commissioned, neither the requirements for a claim for damages under Section 280 Paragraph 1 of the German Civil Code nor the requirements of Sections 280 and 286 of the German Civil Code were met. III. 80 The decision on costs is based on Sections 92 Paragraph 1 and 97 Paragraph 1 of the German Code of Civil Procedure. 81 The decision on provisional enforceability is based on Section 709, Sentence 1 and Sentence 2 of the Code of Civil Procedure. 82 The following amounts in dispute were to be assumed (cf. OLG Karlsruhe, decision of 19.06.2023 - 10 U 24/22, paras. 29, 31, 37, 41 f.): 83 Application for a declaratory judgment for a 30-day ban on use: €2,000 Claim for data correction: €1,250 Claim for injunctive relief: €1,500 Settlement of information (after calculating the difference to determine the interest in costs, for details see OLG Düsseldorf, decision of 05.05.2009 - 24 W 26/09, juris): 396.20 € - Page 14 of 15 - 84 This results in a value in dispute for the appeal proceedings of €5,146.20. Since the auxiliary applications each represent an economic loss compared to the main applications (items 2 and 3), they were not to be taken into account as an increase in the value in dispute. 85 Contrary to the plaintiff's opinion, admission of the appeal was not necessary because neither the legal matter is of fundamental importance nor does the uniformity of the case law or the development of the law require a decision by the appeal court (Section 543, Paragraph 2 of the Code of Civil Procedure). The plaintiff has not shown any case law of the highest or higher courts that, in the case of child pornography content being posted on a user account, considered the temporary deactivation for the purpose of review to be contrary to contract/law (appeals items 1 and 3); the question of the admissibility of the declaratory action item 1 - which has been answered differently in the higher courts' case law - is therefore not relevant in this case. The same applies to the plaintiff's alleged right to demand information about the reason for deletions of third-party content in the past. With regard to the right to data rectification and in particular the applicability of Art. 17 para. 3 lit. e GDPR, there are indeed differing higher court decisions; the question of the necessity of further retaining personal data for the purposes of legal defense is, however, always - as in the present case - shaped by the circumstances of the individual case and is not based on a fundamentally different legal opinion in the sense of a deviation in an abstractly formulated legal principle (Anders/Gehle/Nober, 83rd edition 2025, ZPO § 543 marginal no. 15, beck-online). - Page 15 of 15 -
