OLG Karlsruhe - 15 Verg 8/22
From GDPRhub
| OLG Karlsruhe - 15 Verg 8/22 | |
|---|---|
 | |
| Court: | OLG Karlsruhe (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5 GDPR Article 25 GDPR Article 28 GDPR Article 32 GDPR Article 42 GDPR |
| Decided: | 07.09.2022 |
| Published: | 09.09.2022 |
| Parties: | |
| National Case Number/Name: | 15 Verg 8/22 |
| European Case Law Identifier: | |
| Appeal from: | VK Baden-Württemberg 1 VK 23/22 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | OpenJur (in German) |
| Initial Contributor: | n/a |
The OLG Karlsruhe overturned a decision of the procurement chamber of Baden-Württemberg holding, among other things, that the mere fact that a data processor is the subsidiary of a third-country business group does not put into doubt the processor's commitment to exclusively process personal data in the EEA.
English Summary
Facts
The respondents issued a Europe-wide invitation to tender for the procurement of a digital discharge management software. One of the exclusion criteria ("A-Criteria") was the software-related compliance with a GDPR draft contract. Additionally, the fact that the data is exclusively processed in an EEA data centre where no subcontractors / group companies are located in third countries, was designed as an evaluation criteria ("B-Criteria"). Both the applicant and the interested third party submitted a bid. The respondents awarded the contract to the third party.
The applicant complained that the interested third party should have been excluded from the tender evaluation because, among other things, their bid violated the mandatory legal requirements of the GDPR by processing personal data on servers to which third countries had access. They used A. S.à.r.l. as a subcontractor. The agreement between the third party and A. S.à.r.l. in implementation Article 28 GDPR allowed A. S.à.r.l. to disclose personal data processed on behalf of the customer without or contrary to the customer's instructions and to transfer such data to a third country if this is necessary to comply with laws or binding orders issued by a state authority. Moreover, a supplementary addendum to the agreement stated that A. S.à.r.l. would challenge any unreasonable request by a governmental body. This already showed that A. S.à.r.l. assumed that he would be subject to a request for surrender by the US authorities.
The respondent and the interested third party argue to the contrary that the bid does not constitute an infringement against the GDPR since a theoretical possibility of access by the third country does not constitute a transfer of personal data. Moreover, the defendant used standard contractual clauses and implemented the supplementary provisions required by the ECJ under the Schrems II case law through further agreements with A. S.à.r.l..
The procurement chamber agreed with the applicant, reasoning that the interested third party's bid was therefore to be excluded from the award procedure because the intended use of A. S.à.r.l. violated Article 44 et seq. of the GDPR. The fact that the defendant uses A. S.à.r.l. as a hosting service provider constitutes a transfer within the meaning of Article 44 et seq. (whereby the provisions were also applicable to the disclosure of personal data to a processor in a third country). It was sufficient if personal data was posted on a platform that could be accessed from a third country. This applies regardless of whether the access actually takes place and whether the server through which the data is made accessible is located within the EU. The agreements concluded by the defendant with A. S.à.r.l. opened up the possibility for both state and private bodies outside the EU, and in particular in the USA, to access data stored at A. S.à.r.l.. A. S.à.r.l. promised challenges against requests by governmental authorities does not eliminate the latent risk of access by these authorities.
The respondent decided to appeal this decision on the ground that:
(1) Their offer provided for data processing exclusively on a server of a German GmbH located in Germany. It would only use regional services that did not require any data transfer, so that the associated processing of customer data would take place exclusively in Europe.
(2) A. S.à.r.l. was not authorised to unilaterally change the agreed region of service provision and had assured the respondent that it would provide the service to the respondent in a manner that complied with data protection law.
(3) Even the latent risk of a transfer of personal data to the USA assumed by the Public Procurement Tribunal did not exist, because the encryption technology used by it did not allow this.
Holding
The court appealed the decision by the procurement chamber and held that the interested third party did not deviate from the respondents' requirements for data protection and IT security.
First, the court pointed out the legal circumstances at hand. Namely:
(1) That the contracting authority may generally assume that a tenderer will fulfil its contractual commitments. Only if there are concrete indications that this is doubtful, the contracting authority is obliged to verify the fulfilment of the performance promise or the sufficient capability of the tenderer by obtaining additional information.
(2) That the software compliance with the draft GDPR contract is an exclusion criterion while the requirement that the data be processed exclusively in an EU/EEA data centre where no sub-service provider / group company is located in third countries is only an evaluation criteria.
Consequently, the court held that
(1) The respondents may rely on the promise of performance made in the GDPR contracts. It assured that personal health data transferred to A. S.à.r.l. would not leave the EU for processing, but would only be processed in Germany. In addition, the respondent stated that A. S.à.r.l., L. had assured that they would conclude all internally necessary contracts until the offer was implemented.
(2) Contrary to the applicant's opinion, the mere fact that A. S.à.r.l. is a subsidiary of a US-American group did not have to make the respondents doubt the fulfilment of the promise of performance. The respondents did not have to assume that, due to the group affiliation, instructions to the subsidiary would be given that were contrary to law and to the contract, or that the European subsidiary would follow instructions from the US parent company that were contrary to law.
(3) There was no need to carry out a transfer impact assessment since the respondents did not have to assume that the personal health data would be transferred by the respondent to a third country.
(4) Promises regarding organisational and technical measures to secure encryption which are necessary to ensure that the transfer of data to the USA complies with the provisions of the GDPR are irrelevant regarding the agreement to exclusively process the data in Germany.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
tenor 1. The decision of the Baden-Württemberg Public Procurement Chamber of July 13, 2022, Az. 1 VK 23/22, is rescinded. The applicant's request for review is rejected. 2. The applicant shall bear the procedural costs incurred by the public procurement tribunal and the necessary expenses incurred by the respondent and the summoned party for appropriate legal prosecution. The involvement of a lawyer by the respondent and the summoned party is declared necessary. 3. The applicant must bear the costs of the complaints procedure and reimburse the respondent and those summoned for the costs necessary for the appropriate settlement of the matter. 4. The value of the complaints procedure is set at up to €6,000. reasons I The opponents advertised the procurement of software for digital discharge management in an open procedure for 3 years with a two-time extension option of one year each. The applicant and the summoned party made an offer. After the opponents announced that they wanted to award the applicant's offer, the summoned complained of violations of the contract. The opponents helped (partly) and put the procedure back to the status before the award documents were sent. The tender documents (as of February 23, 2022) stipulated that the offer was to be drawn up in German. The contract should be awarded to the most economical offer, with the total net price being included in the evaluation at 65% and the quality at 35%. In the performance requirements, the respondents specified criteria leading to exclusion (A criteria). One of the exclusion criteria was the technical software compliance with a DS-GVO draft contract, which was part of the tender documents (AST 6). The fact that the data is processed exclusively in an EEA data center where no sub-service providers / group companies are based in third countries was designed as a B criterion that was only relevant for the evaluation. The tender documents (as of February 23, 2022) also stipulated that the price component "one-off costs for the implementation of the digital discharge management software" should not be included in the evaluation. In the delayed procedure, the applicant and the summoned party submitted an offer. In a letter dated May 4, 2022, the respondents informed the bidders that the intention was to award the bid to the party invited. In a letter dated May 9, 2022, the applicant complained that the summoned party should be excluded from the bid evaluation because she had made changes to the tender documents. Their offer violates the mandatory legal requirements of the DS-GVO, they process personal data on servers that third countries have access to. You put the A. S.à.r.l. as a subcontractor. According to the existing agreement between this and the summoned party in the implementation of Art. allow the personal data processed on behalf of the customer to be disclosed and transmitted to a third country, even without or contrary to the customer's instructions, if this is necessary to comply with laws or binding orders of a state authority (A. GDPR DATA PROCESSING ADDENDUM, AST 15: hereinafter A.DPA). In a SUPPLEMENTARY ADDENDUM to the A. DPA, A. declares that it will challenge any excessive or unreasonable request from a government body, including requests that conflict with EU or applicable member state law. This already shows that A., despite the server location in F., assumes that he is subject to a demand for surrender from the US authorities. The co-invoked named T. Inc. as a subcontractor for sending transactional emails. She, the applicant, was aware from another award procedure that the summoned party was actually T. Ltd. use. The summoned party submitted an inadmissible low-cost offer. A proper price check according to § 60 paragraph 2 VgV did not take place. The price evaluation is discriminatory and non-transparent because the one-time costs of implementing the software were not taken into account. In a further letter dated May 12, 2022, the applicant complained that the preliminary information letter was insufficient; the bid evaluation and the documentation of the award procedure are incorrect. After the opponents did not remedy the complaints, the applicant submitted an application for review to the Baden-Württemberg Public Procurement Chamber, with which she repeated and deepened the complaints that had already been raised. In addition, she asserted that, contrary to her declarations in the tender documents, the party summoned had not named another subcontractor, namely I., and had violated the requirement that the offer was to be submitted exclusively in German, because the party summoned in connection with the use of T. Inc. enclosed a "transfer impact assessment" with the offer, which was apparently written in English. The respondent and the summoned party took the view that the summoned party could not be ruled out. There is no violation of Art. 44 ff. DSV-GO, because a theoretical possibility of access by the third country does not represent a transmission of personal data. In addition, use the attached standard contractual clauses and set further agreements with A. S.à.r.l. the supplementary regulations required by the ECJ according to the Schrems II case law. In the dark, the applicant alleges data protection law inadmissible data processing by T. Inc. and missing information on subcontractors (T. Inc. instead of T. Ltd.; I.). They were named as a precautionary measure; there is no reference to an order. Insofar as the applicant believes that the party summoned violates the mandatory specifications of the specifications in connection with the use of A. S.à.r.l. as a subcontractor because its parent company is based in a third country, an exclusion cannot be based on this. Because the respondents did not design the specification as an exclusion but only as an evaluation criterion. With the challenged decision, the public procurement tribunal instructed the opponents to return the procedure to the status before the bid was evaluated if the intention to procure remained. The applicant's request for review is partially inadmissible. The complaint that the one-off costs for the implementation of the software were not taken into account in the price evaluation is precluded according to Section 160 (3) sentence 1 no. 3 GWB. The breach of procurement law was immediately apparent from the procurement documents. The complaint that the evaluation of the offer was incorrect was made out of the blue. The applicant draws this conclusion due to an incorrect understanding of the preliminary information letter of May 4, 2022. The opponents stated that the evaluation was carried out by means of a "cost-effectiveness analysis according to the evaluation criteria of the tender documents"; consequently, an overall assessment of price and performance took place. In addition, the respondents had made a proper assessment. The complaint that the summoned party had given incorrect information about the subcontractor T. Inc. was made in the dark. It is not sufficient for this that the applicant stated in the letter dated May 9, 2022 that she had gained this knowledge on the basis of another award review procedure initiated by the summoned party with comparable requirements. They do not explain where they got the knowledge from, because oral hearings before the public procurement tribunal are not public and the final decision in this review procedure has not yet been made. The applicant also does not explain why the use of T. Ltd. constant practice of those summoned. In the dark, the applicant also complained that the summoned party had not written the offer exclusively in German and, contrary to their declaration I., was using them as a subcontractor. These are pure conjectures on the part of the applicant. Otherwise, the request for review is admissible. The complaint that the applicant had been insufficiently informed of the reasons for her non-consideration under Section 134 (1) GWB is unfounded. Through the letter of reprimand, the applicant was able to protect its rights by submitting an application for review. With the exception of insufficient documentation about the price clarification, the applicant did not explain how any lack of documentation had a negative impact on her legal position in the proceedings. The complaint of insufficient price information is unfounded. Because it could not be determined that the respondents violated § 60 paragraph 3 sentence 1VgV. With regard to the similar prices of the offers of the party summoned and the applicant, the threshold of 20% was not exceeded. In addition, the Respondents had asked those summoned to disclose the cost calculation and to clarify the difference between the current offer and the offer submitted before the transfer. The explanations of those summoned had led to the understandable conviction of the opponents that the price offered did not conflict with proper performance of the contract. However, the admissible and justified complaint was that the offer made by the parties involved did not correspond to the tender documents and should therefore be excluded from the tender procedure in accordance with Section 57 (1) No. 4 VgV because it was due to the intended use of A. S.à.r.l. violate Art. 44 et seq. GDPR. By the co-summoned A. S.à.r.l. as a hosting service provider and the commissioning of A. is based, among other things, on the A. DPA, there is a transmission within the meaning of Art. 44 et seq. DSV-GO, whereby the regulations also apply to the disclosure of personal data to a processor in are applicable in a third country. It is sufficient if personal data is posted on a platform that can be accessed from a third country. This applies regardless of whether the access actually takes place and whether the server through which the data is made accessible is located within the EU. A possibility of access, for example by granting access rights, harbors a latent risk that an impermissible transmission of personal data takes place without the legal basis standardized for this in the DSV-GO. Also those summoned by A. S.à.r.l. agreements made did not lead to a different assessment. Because the corresponding provisions are designed as general clauses and open up the possibility for both state and private bodies outside the EU and especially in the USA, within the framework of the contractual or legal authorizations applicable in the specific case, to rely on A. S.à.r.l. access stored data. To the extent that A. S.à.r.l. obligation to contest overly extensive or inappropriate requests from government agencies, including requests that would conflict with EU law or applicable Member State law, this does not eliminate the latent risk of access by these agencies. The same applies to the encryption technology used by the summoned party, whereby her statements and those of the respondents in the review proceedings would have to be disregarded anyway because the relevant pleadings had been blacked out for the other parties involved. There is no adequacy threshold under Art. 45 (1) GDPR. The use of the standard data protection clauses is not suitable for legitimizing the transmission. Rather, it requires a case-by-case examination, which in the present case leads to inadmissibility under data protection law. Insofar as the offer documents contain the requirement for data protection and IT security, according to which data may only be processed in an EU or EEA data center, this is only designed as an evaluation criterion, so that an exclusion cannot be based on it. With its immediate appeal directed against this, the co-invoked seeks to overturn the decision of the public procurement tribunal and to reject the application for review. You have not changed the tender documents. Concrete facts that indicate a future non-compliance with the data protection regulations, which you, the summoned party, guarantee, are not available. The detailed examinations of the respondents did not result in such a finding. Your offer provides for data processing exclusively on a server of a German GmbH located in Germany. It will only use regional services that do not require data transfer, so that the associated processing of customer data takes place exclusively in Europe. The A. DPA is made available to all A. customers as a standard document, but does not apply in the specific case. In addition, A. S.à.r.l. not authorized to unilaterally change the agreed region of service provision. The choice of service and regions is the sole responsibility of A. customers. A. S.à.r.l. is also not entitled to treat the customer data differently than under the data transmission mechanism valid at the time the contract was concluded with the customer. A. S.à.r.l. have assured the summoned party that they will provide the service to them in a manner that complies with data protection. Even the latent risk of a transfer of personal data to the USA, as assumed by the Public Procurement Chamber, does not exist because the encryption technology it uses does not allow this. The Cloud Act does not apply to A. S.à.r.l.. In any case, a theoretical possibility of access does not represent data transmission within the meaning of Art. 44 et seq. DS-GVO. she requests 1. Annul the decision of the Public Procurement Chamber of Baden-Württemberg of July 13, file number 1 VK 23/22, and reject the application for review; 2. alternatively, to oblige the public procurement tribunal to make a new decision on the matter, taking into account the legal opinion of the court seised; 3. Order the Respondent to pay the costs of the proceedings, including the expenses necessary for the appropriate legal prosecution of the Complainant. The Respondents apply for 1. Annul the decision of the Public Procurement Chamber of Baden-Württemberg of July 13, file number 1 VK 23/22, and reject the application for review; 2. order the respondent to pay the costs of the complaints procedure, including the extrajudicial costs necessary for appropriate legal prosecution; 3. to declare that it is necessary for the respondent to consult the attorney-in-fact. You should have evaluated the offer of the summoned parties and not have to exclude it because of inadmissible changes or additions to the tender documents. For the rest, the Respondents agree with the reasoning of those summoned. The applicant requests dismiss the immediate appeal. She defends the decision of the Public Procurement Chamber by repeating her previous submissions. From the award procedure, VK Bund, Az. VK ..., she knows that the party summoned T. Ltd. as a subcontractor. to send so-called transaction mails in connection with their web-based software solution. However, she did not indicate this as a subcontractor. In addition, the summoned party used the company I. as a subcontractor without having stated this, which they also knew from the aforementioned proceedings. On this, too, the exclusion of the offer of the party summoned should be based, contrary to the opinion of the public procurement tribunal. Your lecture was not carried out out of the blue. In addition, the summoned party, as she also knows from the above-mentioned award procedure, submitted a document in English language contrary to the specifications of the tender documents and thus violated the specifications of the tender documents. With the intended award of the contract to the offer of the parties summoned, the respondent would violate § 60 Para. 3 Sentence 1 VgV. The new offer from those summoned made up only 10% of the initial offer in individual positions. It can be assumed that the offer is not sufficient. Contrary to the statements made by the Respondents, the explanations given by the parties summoned in the letter of April 8, 2022 were merely put forward and incorrect in terms of content. Contrary to the opinion of the public procurement tribunal, the price had to be clarified even below the order threshold of 20%. Because the co-invoked had already explained to the significantly higher initial offer that the prices had been calculated adequately at the lowest limit. With her complaint that it is illegal under public procurement law not to take into account the one-off costs for the implementation of the digital discharge management software when evaluating the overall price, she is not precluded. This circumstance only became apparent to them when they received the bidder information letter, since it was only at this point in time that an in-depth legal examination of the problem of proper price valuation, including all relevant components, took place. In addition, the preliminary information letter was insufficient. The Respondents made an incorrect assessment. From the parts of the notice of award made available to her, it can be inferred that the opponents of the application did not evaluate the offers on the basis of the criteria of quality and its sub-criteria. Contrary to the specifications in the tender documents (specification no. 2.5), the opponents had evaluated the content of the verifying test. This represents a violation of Section 58 VgV in conjunction with Section 127 (1) sentence 1 GWB. In the oral hearing before the award board, the applicant asserted that, based on a search conducted yesterday, it had been established that the summoned party used C. in her application, in which, according to A., the data was in the USA and her, the applicant , IP address would be transmitted to the USA. II. The admissible appeal is partially well founded. 1) The review procedure is permissible, in particular the threshold value pursuant to Section 106 (1) sentence 1 (2) no. 1 GWB has been complied with. The focus here is on the proper estimate of the order value, regardless of whether the specific offers fall below the relevant threshold values (cf. Röwekamp in Röwekamp/Kus/Portz/Prieß, GWB-Vergaberecht, 5th edition 2020, § 106 marginal number 10). 2) The request for review is partially inadmissible. a) The complaint that it is inadmissible under public procurement law not to take into account the one-off costs for the implementation of the digital discharge management software when evaluating the total price is precluded in accordance with Section 160 (3) sentence 1 no. 3 GWB because the applicant submitted the complaint not until the expiry of the deadline for submitting the offers, but only after the expiry of this deadline. The public procurement tribunal rightly pointed out that the applicant could have recognized the alleged violation if it had exercised the necessary care, because a bidder with average expertise and exercising the usual care could have recognized the alleged violation of public procurement law without legal advice (ECJ, decision of March 12, 2015, C - 538/13 - Vigilo, juris para. 58; Senate, decision of February 19, 2020, 15 Verg 1/20, juris para. 28). The focus here is not on the specific company applying, but on a company that already has some experience in procurement procedures (Senate, loc. cit.). An entrepreneur who takes part in an EU-wide procurement procedure must at least take note of the text of the relevant rules of procedure; He must investigate inconsistencies or contradictions in the tender documents, even if he does not know the exact legal situation (cf. summary in Heiermann/Zeiss/Summa, jurisPKVergaberecht, 5th edition 2016 - as of June 21, 2021, § 160 GWB marginal number 277). Whether the applicant only dealt in depth with the pricing in the tender documents after receiving the letter of refusal dated May 4, 2022 is irrelevant in this respect. The fact that the one-off costs for the implementation of the digital discharge management software would not be taken into account in the price evaluation was shown by reading the information on price evaluation in the tender documents (as of February 23, 2022) and the price sheet (as of February 23, 2022), in which this is highlighted in red. Each bidder can make the legal assessment of whether such a price specification is possibly non-transparent and discriminatory. In addition, reference is made to the relevant statements made by the Public Procurement Chamber. b) The complaint that the opponents of the application had obviously incorrectly based solely on the price, although according to the tender documents the quality should also be evaluated, was raised by the applicant just as randomly as the complaint that the verifying test was included in the evaluation, although this was 2.5. was not provided for in the specifications. Such indications arose neither from the partially blackened award notice given to the applicant during the inspection of the files nor from the bidder information letter. Arbitrary allegations made at random or out of the blue are procedurally irrelevant (cf. Dicks in Ziekow/Völlink/Dicks, 4th edition 2020, GWB § 160 para. 18). Measured against this, the above complaints are to be qualified as inadmissible. The assertion that, contrary to the tender documents, the opponents of the application included the test in the evaluation is based on an understanding of the (partially redacted) award notice made available to the applicant that is not justified by facts. Insofar as it is stated in the award note under No. 16 that the test is described as "good", this does not indicate that the verifying test was included in the evaluation. A verifying test only serves to check whether certain criteria have been met after completing an evaluation according to the records. The use of the term "good" does not mean that the test was part of the evaluation and not subsequent to it. The term was obviously used in an unspecific manner and is not equivalent to an evaluation of school grades, which the Respondents did not provide for in this respect. The bidder information letter to the applicant dated May 4, 2022 does not offer any indication of an evaluation carried out contrary to the published evaluation criteria and thus of a violation according to § 58 VgV. The opponents of the application informed the applicant that, based on the evaluation criteria of the tender documents, their offer had not been the most economical in the assessment of the price. In the overall evaluation of price and performance, their offer was ranked 2nd. The letter uses "evaluation criteria" in the plural, further states that the applicant's offer is not the most economical in terms of price, was clearly meant, was not in first place, and in the third sentence names the two evaluation criteria (price and service). c) As the Public Procurement Chamber explained, the applicant is not entitled to file a complaint regarding a bidder information letter that does not meet the requirements of Section 134 GWB due to a lack of explanation of any damage caused by the alleged violation of public procurement law, Section 160 (2) GWB. aa) Since the Respondents have not yet awarded any bids, proper notification pursuant to Section 134 GWB can only be of importance for compliance with the notice period and the substantiation of a violation of public procurement law. However, the applicant accused the respondents of numerous violations within the statutory period. It is not apparent that she could have been unaware of further violations due to insufficient information and the applicant has not indicated it either. bb) The complaint would also be unfounded. The notification by the respondent dated May 4, 2022 that the intention was to award the contract to the tendered party's offer meets the requirements of Section 134 (1) GWB. According to this provision, a contracting authority must inform the bidders whose bids are not to be considered (among other things) of the reasons why their bid is not to be considered. The justification for a rejection letter that the losing bidder did not submit the most economical offer may not meet the legal requirements under certain circumstances. As already stated, a synopsis of the declarations made in the information letter shows that the offer of the party summoned was cheaper in terms of price. The provision does not require a detailed justification. d) Complaints about insufficient documentation according to § 8 VgV are inadmissible. aa) A bidder can only rely on missing or insufficient documentation if the deficiencies in this regard have had a negative impact on his legal status in the procurement procedure; the documentation is not an end in itself (cf. Munich Higher Regional Court, decision of November 2nd, 2012, Verg 26/ 12, juris para. 26; OLG Frankfurt, decision of January 23, 2007, 11 Verg 11/06, juris para. 43). Rather, the decisive factor is that the documentation deficiencies to be determined relate to the assessment process itself and, without sufficiently detailed and comprehensible documentation, it cannot be checked from the point of view of a fellow bidder or the reviewing bodies and it cannot be determined whether the contracting authority is moving within the scope of its assessment scope and whether it is factually correct made a decision or was guided by irrelevant, non-public procurement aspects (OLG Frankfurt, loc.cit.). The applicant merely claims in the dark that a large number of the decisions and processes that are essential for the award were not sufficiently documented by the opponents. She did not explain in detail what these are and why this violates her rights. This applies in particular against the background that the applicant was already in first place for the criterion of performance, which she was aware of from the bidder information letter. The possibility of being able to determine any further violations of rights, which the applicant cites as justification, is not sufficient for a violation of rights under Section 160 (2) GWB. bb) Irrespective of this, the complaint would also be unfounded. The provisions in § 8 VgV require ongoing documentation of the relevant stages of the award procedure and, in particular, a comprehensible evaluation decision in terms of content. The respondents complied with this requirement when preparing an evaluation matrix. 3) Otherwise, the request for review is admissible, but unfounded. a) The complaints that the summoned put the T. Ltd. instead of T. Inc., stated as the subcontractor, that they had not stated I., used by T., as a further subcontractor and, in connection with the use of T. Inc., enclosed a "transfer impact assessment" with the offer, which apparently in was written in English, did not happen out of the blue. aa) For reasons of acceleration as well as to prevent misuse of the complaint or the review procedure, the contracting authority cannot generally be expected to enter into a precise, possibly renewed determination of the facts in response to a completely unsubstantiated complaint. Therefore, the applicant is required to exhaust sources of knowledge that are available without great effort when examining the question of whether a violation of public procurement law is to be reprimanded. In addition, he must state where his findings come from (cf. OLG Düsseldorf, decision of March 29, 2021, VII-Verg 9/21, juris marginal note 43 with further references). The applicant has already done this in the letter of complaint dated May 9, 2022 regarding the use of T. Inc. Because she explained that she had gained knowledge about their use in connection with transaction emails based on an award procedure in which she and the summoned party were also involved. She then extended her presentation with regard to the other subcontractor, I., and the submission of a document in English for the same reason. bb) However, the complaints are unfounded. The offer of the co-invoked cannot be excluded according to §§ 53 Para. 7, 57 Para. 1 No. 4 VgV due to changes to the tender documents. (1) A change to the tender documents is always present if a direct change has been made to the content of the tender blank provided by the client, including all its components (cf. Verfürth in Kulartz/Kus/Marx/Portz/Prieß, VgV, § 53 paragraph 64). According to the justification for the draft bill, Section 53 (7) VgV serves to make the information submitted comparable and is intended to prevent the risk that contracting authorities will accept an offer that does not meet their requirements (justification for the draft bill, page 187). Consequently, a change in the tender documents requires that the bidder makes declarations in relation to the specific procurement that is put out to tender contrary to the specifications. In order to determine whether a bidder has inadmissibly changed the tender documents, his offer must be compared with the requirements of the contracting authority specified in the tender documents for the service to be provided (Dittmann in Kulartz/Kus/Marx/Portz/Prieß, VgV, § 57 para .54). (2) The summoned party indicated that T. Inc. was named in connection with "transactional e-mails and short messages" (see AVV contract, Appendix 3). A subcontractor within the meaning of the tender is, according to § 1 paragraph 2 of the AVV contract, a "commissioned service provider whose service and/or work the contractor needs to provide the services described in this contract to the client". However, the transactional, i.e. automatically sent e-mails and short messages are not part of the tender. Therefore, the complaint that the summoned party uses I. as a further subcontractor and has submitted a document in English is ineffective. (3) In addition, § 36 Paragraph 5 VgV provides for the right of the client to demand the replacement of the subcontractor in the event that the subcontractor is found to be unsuitable. If a possible unsuitability of the subcontractor does not have to lead to exclusion, nothing else should apply to a wrong designation. b) The offer of those summoned cannot be ruled out either, because their offer deviates from the requirements of the respondents in terms of data protection and IT security. aa) Without objecting to Section 127 (4) sentence 1 GWB, the contracting authority may generally assume that a bidder will fulfill its contractual commitments (OLG Düsseldorf, decision of 08/26/2018, Verg 23/18, juris para. 71; KG , decision of November 21, 2014, Verg 22/13, juris, para. 36). Only if there are concrete indications that this is doubtful is the contracting authority required to obtain additional information to check whether the performance promise can be fulfilled or whether the bidder is able to perform adequately (OLG Düsseldorf, loc.cit.; KG, loc.cit.; OLG Frankfurt a.M., decision of June 16, 2001, 11 Verg 3/15, juris, para. 82; OLG Brandenburg, decision of November 20, 2012, Verg W 10/12, juris para. 21). bb) The tender documents required software-related compliance with the attached GDPR draft contract (4.1.1. lit. c of the tender documents). It goes on to say, "the details result from the specifications and the specifications of the tender documents." In the specification it says under 2.8 "Fulfillment of the requirements from the DS-GVO and the BDSG, in particular - Fulfillment of the data protection principles, Art. 5, 25 DS-GVO (in particular data minimization, data protection through technology design, data protection through data protection-friendly default settings) - Implementation of sufficient technical and organizational measures (Art. 32 GDPR) or other suitable guarantees (e.g. certification according to Art. 42 GDPR); There must be an opportunity for an on-site inspection of the contractor." In the specifications, the respondents point out that the requirements for the services are designed as A criteria leading to exclusion and B criteria relevant to the assessment. According to this, the sole exclusion criterion is the software-technical compliance with the DS-GVO draft contract (specification no. 19), while the DS-GVO-compliant software-technical possibilities for authorization control (specification no. 20) and the specification according to which the data can only be stored in one EU/EEA data center where no sub-service provider / group company is based in third countries (specification book no. 21), designed as B criteria. By signing the DS-GVO contracts specified by the respondent, the summoned party has declared that it will comply with the specifications made. It has also described its services in the use of service providers and in the area of data protection and IT security in detail in the offer and made a clear and unambiguous promise of performance. In this context, she has assured that personal health data will only be transmitted to A. S.à.rl, L., and will not leave the EU for processing, but will only be processed in Germany. In addition, the summoned party stated that A. S.à.rl, L. had assured her that all of the summoned party's data would be processed in Germany and also confirmed in the oral hearing before the Senate that she would sign all internally necessary contracts with A. who will implement their commitments as made in the offer. In terms of such a binding assurance, the Respondents also understood the statements made by the parties summoned in the tender documents. Respondents can rely on this promise of performance. (1) The Respondents did not have to have doubts because A. generally concludes contracts involving A. DPA. The A. DPA were not part of the offer made by those summoned. According to the tender documents, the contracts with A. were not to be submitted and were not enclosed with the offer. Consequently, there was no reason for the respondents to doubt the assurances made in the promise of performance, because the A. DPA could possibly have deficits in data protection law, as the Public Procurement Chamber has shown, or because their formulation as a tripartite agreement, in which A. Inc. , USA, could give rise to doubts about compliance with the GDPR. Based on the promise of performance described in the offer and the guarantees given with regard to the specific execution of the order, the Respondents can assume that the party summoned will adhere to this and design their contracts with A. accordingly, regardless of any provisions in the A. DPA, which are designed as general terms and conditions. The co-invoked must therefore ensure that they implement and carry out their services in accordance with the guarantees given. (2) Contrary to what the applicant claims, it was not just the fact that A. S.à.r.l. is a subsidiary of a US group that made the respondents doubt whether the promise of performance could be fulfilled. The Respondents did not have to assume that due to the group affiliation, the subsidiary would receive instructions that were illegal or contrary to contract or that the European subsidiary would follow illegal instructions from the US parent company through its managing directors. (3) The complaint raised by the applicant for the first time at the end of the oral hearing before the public procurement board that the summoned party used C., whereby data from A. were transferred to the USA, the IP address was also transferred to the USA, which denied by the summoned party, is irrelevant because of the principle of acceleration that applies in the award review procedure in the interest of the client and the general public in a quick award of the contract. She did not explain in a comprehensible manner why the applicant could not have complained earlier. It cannot be assumed that the research was particularly time-consuming, because an entry into the R.-APP was sufficient to obtain this information, as the applicant explained. The alleged violation of the GDPR due to a data transfer to the USA was already the core argument of the applicant's letter of reprimand dated May 9th, 2022. Even if one were to consider the presentation admissible, the performance promise of those invited is not called into question. Because it cannot be concluded from this that the use of C. and the transmission of the IP address to the USA is part of the service offered to the respondents. (4) Since the Respondents therefore did not have to assume that the personal health data would be transmitted to a third country by the summoned party as part of the fulfillment of the contract, there was no need to carry out a transfer impact assessment. Its absence does not constitute a deviation from the tender conditions. (5) With regard to the promise of the summoned party that the data will be processed exclusively in Germany, it is irrelevant whether the summoned party promised accompanying organizational and technical measures, in particular with regard to secure encryption, which are necessary, so that the transfer of data to the USA is in line with the provisions of the GDPR. However, the Senate points out that the Public Procurement Chamber, which chose a different legal approach and which therefore depended, among other things, on efficient encryption technology for compliance with the GDPR, should not have ignored the information that the summoned party had marked as requiring confidentiality . In cases in which one of the parties involved does not have to pass on information to protect business secrets, this must be taken into account by means of a corresponding procedure (for details: BGH, decision of January 31, 2017, X ZB 10/16, juris). . c) The Respondents have not violated their obligation to provide information pursuant to Section 60 (1) VgV. You have clarified the prices because the party summoned in the backtracked procedure sometimes offered significantly lower prices than in the original award procedure. The price check covers whether the total price offered is unusually or unreasonably low in relation to the service and whether it is disproportionate to the service (cf. Düsseldorf Higher Regional Court, decision of June 8th, 2016, VII-Verg 57/15, juris). The Respondents carried out a price check aimed at this. The Respondents rated the declarations of those summoned and the documents submitted for this as satisfactory and presented and documented this in the tender documents in a comprehensible manner. In addition, to avoid repetition, reference is made to the applicable statements of the public procurement tribunal. Consequently, the offer of the summoned parties cannot be excluded from the evaluation according to § 60 Para. 3 VgV. III. It was not necessary to decide on the deadline requested by the summoned party for commenting on the applicant's new submissions in the oral hearing before the Senate because, as was explained, it was not important for the decision. IV 1) a) Pursuant to Section 182 (3) sentence 3 GWB, the applicant bears the costs of the proceedings before the public procurement tribunal because it was unsuccessful. b) The applicant must reimburse the respondent for the expenses necessary for the appropriate defense, since it was unsuccessful with its application for review. According to Section 182 (4) sentence 2 GWB, it is fair that the applicant also reimburses the expenses of those summoned. The summoned party deliberately opposed the interests of the losing party, actively participated in the review proceedings with her own factual and legal considerations and, as a result, successfully submitted her own applications or promoted the proceedings significantly (cf. Glahs in: Reidt/Stickler/Glahs , Public Procurement Law, 4th edition 2018, Section 182 GWB, para. 23). c) The involvement of a procedural representative by the respondent and the summoned party is declared necessary. aa) According to Section 182 (4) sentence 4 GWB in conjunction with Section 80 (2) VwVfG, the costs of a lawyer are reimbursable if it was necessary to consult them. The question of whether it was necessary for the contracting authority to hire a lawyer must be decided on the basis of a differentiated consideration of the circumstances of the individual case based on an ex ante forecast (cf. BGH, decision of September 26th, 2006, X ZB 14/06 , juris para. 61; Senate, resolution of 07/11/2011, 15 Verg 5/11, juris para. 17; resolution of 03/10/2015, 15 Verg 11/14, juris para. 9). Aspects such as the simplicity or complexity of the facts, the clarity or difficulty of the legal issues to be assessed, but also the possibility of dealing with procurement law issues properly due to the factual and human resources can play a role. If the problem of a review procedure concentrates on simple order-related factual and legal issues including the associated procurement rules, there is generally more evidence that the contracting authority can organize and muster the necessary technical and legal knowledge within the scope of its original scope of duties itself, it is in the review procedure of a lawyer Assistance is therefore not required (Summa in Heiermann/ Zeiss/Summa, jurisPK-VergabeR, 5th edition 2016, Section 182 GWB, as of November 24th, 2020, para. 95). It must be taken into account that the client must in principle obtain the specialist and legal knowledge required for a review procedure in his or her area of responsibility himself, while dealing with legal questions that are not simple and that are added to the legal questions related to the order, especially if they relate to higher-ranking matters law and European law, may obtain external legal advice if necessary (cf. Senate, decision of 07/11/2011, loc.cit., juris para. 17; Senate, decision of 03.10.2015, loc.cit., juris para. 9). After that, the respondents were allowed to consider it necessary to obtain legal advice. Even if some of the complaints were related to the order and could therefore be answered by the respondent themselves, a large number of the complaints raised required an in-depth examination of the German and European provisions on data protection. bb) For the reasons mentioned above, the costs of consulting a lawyer are also necessary for the party summoned. 2) Since the complaint is successful, the applicant has to bear the costs of the complaint procedure in accordance with Sections 175 (2) and 71 sentence 2 GWB. It is also fair that the applicant bears the expenses incurred by the respondent and those summoned in accordance with Sections 175 (2) and 71 sentence 1 GWB. 3) The amount in dispute is determined in accordance with Sections 50 (2) and 39 (2) GKG.
