OLG München - 27 U 2473/24 e
From GDPRhub
| OLG München - 27 U 2473/24 e | |
|---|---|
 | |
| Court: | OLG München (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 13 GDPR Article 14 GDPR Article 17 GDPR Article 21 GDPR |
| Decided: | 19.11.2024 |
| Published: | 12.12.2024 |
| Parties: | |
| National Case Number/Name: | 27 U 2473/24 e |
| European Case Law Identifier: | ECLI:DE:OLGMUEN:2024:1119.27U2473.24E.0A |
| Appeal from: | LG Augsburg (Germany) 092 O 2439/23 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Bayern.Recht (in German) |
| Initial Contributor: | tjk |
A court held that the controller's interest in assessing credit risk related to payment defaults overrode the data subjects interest even though the debt was relatively small and subsequently settled.
English Summary
Facts
The controller is a credit rating agency maintaining a database with 68,000,000 Germany-related datasets. The contractual partners of the controller transmit data from their customers to the controller. The controller stores the data it receives from its partners. In turn it calculates and provides its partners with information on which the statistical risk of payment default.
The data subject is a craftsman and requested the erasure of an entry on his creditworthiness stored by the controller regarding a debt between €300 and €400 for which payment had been in default for months.
The controller rejected the request. Consequently, the data subject filed a lawsuit requesting erasure of the entry based on Article 17 GDPR with the Regional Court of Augsburg (Landesgericht Augsburg - LG Augsburg). The court found the claim to be unfounded as the controller was justified in processing the data under Article 6(1)(f) GDPR.
The data subject appealed this decision and brought forward that the controller should have notified the data subject of the data processing through push-notifications.
Holding
In the Appeals process the Higher Regional Court Munich (Oberlandesgericht München - OLG München) fully upheld the decision of the first instance. It maintained that the interest of the controller for storing the data is not overridden by legitimate interests of the data subject. Even though the debt was eventually settled the information stored by the controller remained suitable for assessing the credit score.
The court also agreed with the first instance that even the payment history on small amounts (in the case at hand an amount below €400,00) is appropriate for future risk assessments. Regarding the fact, that the data subject had eventually paid the claim the court agreed with the first instance that even a late payment is relevant for risk predications.
The court held that while the controller is obliged to inform the data subject in accordance with Article 13 and 14 GDPR, there is no obligation to send push notifications on the data subject’s smartphone.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Title:
No right to delete a negative entry or to recalculate the score value against a credit agency
Chain of standards:
GDPR Art. 2 Para. 1, Art. 4 No. 1, Art. 6 Para. 1 lit. f, Art. 13 Para. 1 lit. d, Art. 14 Para. 2 lit. b, Art. 15, Art. 17 Para. 1 lit. a, c, d, Art. 21 Para. 1 S. 1
Principles:
1. Operating a credit agency on credit-relevant circumstances to support contractual partners in assessing creditworthiness represents a legitimate interest within the meaning of Art. 6 GDPR and makes the processing of data records on a person's payment behavior necessary. (para. 14) (editorial guideline)
2. The necessity of data processing for the purpose of a credit assessment is not contradicted by the fact that it involves a delayed payment of an amount in the order of €300 - €400. (Rn. 15) (editorial guideline)
Keywords:
Appeal, General Data Protection Regulation, right to deletion, score value, violation of rights, right to be heard, credit rating
Lower court:
LG Augsburg, judgment of June 17, 2024 - 092 O 2439/23
Source:
GRUR-RS 2024, 33167
Tenor
1. The Senate intends to dismiss the appeal against the judgment of the Regional Court of Augsburg of June 17, 2024, case number 092 O 2439/23, in accordance with Section 522 para. 2 of the Code of Civil Procedure, because it is unanimously of the opinion that the appeal obviously has no prospect of success, the legal matter is also of no fundamental importance, neither the development of the law nor the securing of uniform case law requires a decision by the appeal court and the holding of an oral hearing on the appeal is not necessary is.
2. There is an opportunity to comment on this until December 20, 2024.
3. The Senate intends to set the value in dispute in the appeal proceedings at €6,000.00. The parties can also comment on the value in dispute in the appeal proceedings within the aforementioned period.
Reasons for the decision
1
1. The plaintiff's appeal is admissible in accordance with Section 511 Paragraph 1 of the Code of Civil Procedure and reaches the value of the complaint required under Section 511 Paragraph 2 No. 1 of the Code of Civil Procedure. The appeal was also filed and justified in accordance with Sections 517, 519, and 520 of the Code of Civil Procedure in due form and within the time limit. The appeal sufficiently shows the reasons the plaintiff puts forward against the considerations of the regional court.
2
2. However, the appeal is obviously unfounded. The contested decision is neither based on a violation of law nor do the facts to be taken as a basis in accordance with Section 529 Paragraph 1 No. 1 of the Code of Civil Procedure justify a different decision (Section 513 Paragraph 1 of the Code of Civil Procedure). Legal errors relevant to the decision within the meaning of Section 520 Paragraph 3 of the Code of Civil Procedure are not apparent and are not pointed out by the appeal. In the contested decision, the Regional Court rightly assumed that the plaintiff is not entitled to a claim against the defendant for deletion of the negative entry under Article 17 Paragraph 1 d), a) or c) of the General Data Protection Regulation (GDPR) or a recalculation of his score without taking the disputed entry into account and reimbursement of legal costs. The plaintiff's arguments and legal opinion on this matter expressed in the grounds of appeal do not require a different assessment. The following should be noted regarding the appeals:
3
a) The only basis for the claim for the deletion of the entry is Art. 17 para. 1 d), a) or c) GDPR, since the data protection law, which is conclusively regulated and standardized throughout the Union, has priority of application (cf. BVerfG, NJW 2020, 314 para. 34, 41; OLG Brandenburg, ZD 2023, 748 para. 11, 16). According to this, a claim for deletion requires either unlawful processing of data from the outset or only later becoming unlawful over time. The requirements of Art. 17 para. 1 d), a) or c) GDPR are not met here.
4
aa) The material scope of application of the GDPR is open because the defendant uses the plaintiff's personal data (Article 2 paragraph 1 GDPR in conjunction with Article 4 no. 1 GDPR). There is no lack of the necessary reference to a natural person (see ECJ, NJW 2018, 767, para. 35).
5
bb) The storage and use of the information about the plaintiff was legitimately carried out in accordance with Article 6 GDPR.
6
Article 6 paragraph 1, subparagraph 1 GDPR contains an exhaustive and final list of cases in which the processing of personal data can be considered lawful (see ECJ, NJW 2024, 417, para. 73). In the event of a dispute, the legality of the processing of personal data is to be determined solely in accordance with Article 6 paragraph 1, subparagraph 3. 1 lit. f) GDPR. The European Court of Justice has ruled on Art. 6 Paragraph 1 Subparagraph 1 lit. f) GDPR that this provision is to be interpreted as meaning that processing can only be considered necessary to safeguard the legitimate interests of the controller or of a third party within the meaning of the provision if this processing is carried out within the limits of what is strictly necessary to achieve this legitimate interest and if a balancing of the opposing interests, taking into account all relevant circumstances, shows that the interests or fundamental rights and freedoms of the persons affected by the processing do not outweigh the legitimate interests of the controller or of a third party (cf. ECJ, NJW 2024, 417 para. 88 with further references). According to this provision, the processing of personal data is therefore lawful under three cumulative conditions: first, a legitimate interest must be pursued by the controller or by a third party, second, the processing of the personal data must be necessary to achieve the legitimate interest, and third, the interests or fundamental rights and freedoms of the person whose data is to be protected must not prevail (cf. ECJ, NJW 2024, 417 para. 75).
7
cc) Based on this, the processing by the defendant was carried out to protect its own interests and the legitimate interests of at least its contractual partners as third parties, without the plaintiff's overriding interests being opposed to this (Article 6 (1) subparagraph 1 lit. f) GDPR). The balancing carried out by the regional court in this respect raises no concerns.
8
It is not apparent that the plaintiff's legitimate interests prevail.
9
(1) To the extent that the appellant complains that the regional court assumed as true the assumption that the plaintiff was aware of the title, the appeal contests the regional court's opinion without success. The regional court's assessment exhausts the relevant facts, is comprehensible and consistent and does not violate the laws of logic or principles of experience. In this respect, the first judgment does not give rise to any doubts about the assessment of evidence. The first court's assessment is plausible and convincing when all aspects are taken into account. The Regional Court's assessment is not legally incorrect because the Regional Court found that after a reminder notice was issued on November 29, 2021, which was served on December 2, 2021, an enforcement order was subsequently issued against the plaintiff by the Hünfeld District Court on December 21, 2021, which, according to a note on the enforcement order, was served on the plaintiff on December 24, 2021 (Appendix B 3), and which is not contradicted by the fact that the plaintiff had stated that he had not received either the reminder notice or the enforcement order. In this respect, the Regional Court based its judgment on the defendant's factual submissions on the enforced claim as undisputed factual submissions. This is binding for the Senate according to §§ 314, 529 para. 1 no. 1 ZPO (cf. BGH, NJW-RR 2012, 622, 623). The plaintiff did not challenge the above-mentioned findings of the regional court by means of a request for correction of the facts. According to § 314 ZPO, the Senate must assume the correctness of the facts of the case at first instance, which also includes findings of fact that can be found in the reasons for the decision, as far as its evidentiary value is sufficient (cf. BGH, NJW 1997, 1931; MüKoZPO/Musielak, 6th edition 2020, ZPO § 314 marginal no. 3; Zöller/Feskorn, 35th edition 2024, ZPO § 314 marginal no. 5). The appeal does not provide any concrete evidence that would give rise to doubts about the correctness and completeness of these findings relevant to the decision and therefore require a new determination, given that the delivery note on the enforcement order provides full proof that the title was delivered to the plaintiff (cf. BGH, NJW 2006, 150 para. 12).
10
(2) The plaintiff does not prevail with his appeal insofar as he complains of a violation of the right to be heard (Article 103 para. 1 GG) because the regional court, in breach of procedure, did not consider itself obliged to follow up on the plaintiff's evidence in the form of the witness in the written submission of April 22, 2024. In order for the Senate to be able to examine the causality of a violation of the right to be heard (Article 103, Paragraph 1 of the Basic Law), it must be stated in detail - even if not necessarily in direct connection with the procedural complaint - in the grounds of appeal (Section 520, Paragraph 3, Sentence 2, No. 2 of the Code of Civil Procedure) what would have been presented if the right to be heard had been granted and that it cannot be ruled out that this presentation would have led to a different decision by the court of first instance (cf. BGH, NJW-RR 2020, 573, marginal no. 14; BGH, NJW 2016, 2890, marginal no. 11; Musielak/Voit/Ball, 21st edition 2024, Code of Civil Procedure Section 520, marginal no. 32). A corresponding statement cannot be found in the grounds of appeal dated August 6, 2024, regarding the non-examination of the witness he named, which the plaintiff complained about. This statement was necessary because - which is not the case here - the relevance of the violation of the right to be heard, as complained of by the plaintiff, is not immediately and unambiguously evident from the material in the proceedings to date (cf. BGH, NJW-RR 2020, 573 para. 14; BGH, NJW 2016, 2890 para. 11 with further references).
11
(3) According to the case law of the European Court of Justice, the controller (cf. Art. 4 No. 7 GDPR), who has the actual decision-making power, is subject to the requirements for automated decisions under Art. 22 GDPR (cf. Radtke, MMR 2024, 156). The European Court of Justice (cf. ECJ, NJW 2024, 413 para. 40 ff.) assumes that the creation and transmission of a probability value on the creditworthiness of a natural person ("score") can already be an automated decision within the meaning of Art. 22 para. 1 GDPR, although the Court subjects the score calculation to the requirements of Art. 22 GDPR only under the condition that the decision to conclude a contract "decisively depends" on the score (cf. ECJ, NJW 2024, 413 para. 40, 48, 62, 73 and Marsch/Kratz, NJW 2024, 392 para. 6). Insofar as the plaintiff states that he has been looking for a rental apartment since July 15, 2024 and that "potential landlords" have refused to rent the apartment based solely on the score, the plaintiff fails to recognize that - regardless of the fact that the defendant did not agree to the plaintiff being questioned as a party - his statement is not substantiated in order to take the evidence he had envisaged.
12
(4) The plaintiff's complaint that the regional court assessed "the supposed long period between the registration and repayment" of what the plaintiff considers to be an "extremely small amount" to the detriment of the plaintiff in the context of the balancing required under Art. 6 (1) subparagraph 1 lit. f) GDPR is also unhelpful. The plaintiff's further objection that the defendant did not inform the plaintiff by smartphone push message about changes in the electronic database held on the plaintiff.
13
The information about the payment default and the settlement after registration are indeed personal data within the meaning of Art. 4 No. 1 GDPR, since they relate to the plaintiff as an identified and identifiable natural person. However, the processing of the plaintiff's personal data by the defendant is lawful after a comprehensive balancing of interests in accordance with Art. 6 Paragraph 1 Subparagraph 1 Letter f) GDPR. The processing by the defendant was carried out to protect its own interests and the legitimate interests of at least its contractual partners as third parties, without the plaintiff's overriding interests being opposed to this. The plaintiff's interest as a consumer arises from unhindered participation in everyday economic transactions and the protection of his personal data (cf. LG Koblenz, judgment of October 22, 2024 - 9 O 118/24, BeckRS 2024, 29186 para. 28). The plaintiff, who as the data subject must himself explain the interests to be taken into account in the specific balancing of interests to be carried out in accordance with Art. 6 (1) subparagraph 1 lit. f) GDPR (cf. OLG Stuttgart, judgment of August 10, 2022 - 9 U 24/22, BeckRS 2022, 20818 para. 33; Paal/Pauly/Frenzel, 3rd edition 2021, GDPR Art. 6 para. 31), has not demonstrated that he gave a false impression of himself and that he carried out an incorrect creditworthiness analysis based on this, in particular with regard to the plaintiff's alleged later knowledge of the title of the claim (see above).
14
In contrast, there is the processing of personal data that serves the legitimate interest of the defendant's business model. The defendant concludes contracts with companies that offer services that can in any case also be of a creditor nature. It receives fees from its customers for the opportunity to obtain information about their potential customers that it considers to be credit-relevant. Since all interests within the meaning of Art. 6 GDPR that are of a legal, personal, idealistic or purely economic nature can be legitimate, the defendant's purely commercial interest in the storage also fundamentally represents such a legitimate interest (cf. ECJ, NJW 2024, 417 para. 83; BeckOK DatenschutzR/Albers/Veit, 49th edition, as of August 1, 2024, GDPR Art. 6 para. 68). Storage for this purpose is also necessary because the defendant would otherwise not be able to fulfill its contractual obligations to its customers with regard to inquiries concerning the plaintiff due to a lack of a complete data basis (cf. OLG Stuttgart, judgment of August 10, 2022 - 9 U 24/22, BeckRS 2022, 20818, marginal no. 25; LG Koblenz, judgment of October 22, 2024 - 9 O 118/24, BeckRS 2024, 29186, marginal no. 29). In addition, storage also serves the interests of the defendant's customers as potential lenders or contractual partners of the plaintiff. This is because it forms the data basis for information requested by this limited group of people, with the explanation of a legitimate interest, which will usually be the case if there is a specific intended business relationship with the plaintiff. The fact that the interests of the defendant's customers are not only justified, but are also considered particularly worthy of protection by the legal system - both European and domestic - is evident in particular from Article 18 of Directive (EU) 2023/2225 of the European Parliament and of the Council of 18 October 2023 on consumer credit agreements and repealing Directive 2008/48/EC, which makes the granting of consumer credit subject to a creditworthiness assessment based, among other things, on data such as that of the defendant (cf. Article 8 (2) of Directive 2008/48/EC OLG Cologne, NZI 2022, 565 para. 22; OLG Stuttgart, judgment of 10 August 2022 - 9 U 24/22, BeckRS 2022, 20818 para. 26; LG Koblenz, judgment of 22 October 2024 - 9 O 118/24, BeckRS 2024, 29186 para. 30). Operating a credit agency on credit-relevant circumstances to support contractual partners in assessing creditworthiness, which represents a legitimate interest within the meaning of Art. 6 GDPR (cf. ECJ, NJW 2024, 417 para. 83), also makes it necessary to process the specific data set in question. The plaintiff's payment behavior is also important for assessing the plaintiff's creditworthiness even after the claim has been fully settled (cf. OLG Stuttgart, judgment of August 10, 2022 - 9 U 24/22, BeckRS 2022, 20818 para. 27). The disputed entry makes it clear that the plaintiff did not originally settle the claim underlying the entry - as contractually owed - and that the claim therefore had to be registered and that even after the registration had taken place, the payment claim was not settled immediately by him. Such payment behavior on the part of the plaintiff, in which the plaintiff did not meet his payment obligations from the contractual relationship in question for several months, is important for the assessment of his creditworthiness, since the disputed entry prompts potential contractual partners of the plaintiff to carefully check his creditworthiness. The storage and communication of data on an enforcement title provides information about the debtor's previous ability and willingness to pay. The defendant does not store claims that have already been settled without cause, but is based on the enforcement title for which the plaintiff himself is responsible (cf. LG Koblenz, judgment of October 22, 2024 - 9 O 118/24, BeckRS 2024, 29186, para. 31).
15
The assumption that data processing is necessary is not contradicted by the fact that the amount of the claim reported to the defendant is €385.00 or €389.00. The amount of the claim does not allow the conclusion that the information is unsuitable for credit assessment. No de minimis threshold can be applied to the credit rating, since even the payment behavior with regard to smaller amounts allows statements to be made about the probability of a debtor's future payment behavior when viewed statistically (cf. OLG Frankfurt, decision of March 7, 2024 - 19 U 161/22, p. 8). Smaller amounts can have statistical relevance, especially when viewed in conjunction with other possible circumstances. In particular, several small amounts can have greater statistical relevance in total than a single larger amount. However, the defendant could not make such an assessment if it were prohibited from storing data records with regard to smaller amounts (cf. OLG Frankfurt, decision of March 7, 2024 - 19 U 161/22, p. 8).
16
The plaintiff's objection that it would have been easy for the defendant to inform the plaintiff of changes to the data set by means of a push message on his smartphone does not justify a different result. As a data subject, the plaintiff has the right under Art. 15 GDPR to request confirmation from the defendant as to whether or which personal data concerning him are being processed and to receive a copy of this data. The legality of Art. 6 Para. 1 Subparagraph 1 Letter f) GDPR is also flanked by the procedural obligation of the controller to inform the data subject of his (overriding) interests, Art. 13 Para. 1 Letter d) GDPR or Art. 14 Para. 2 Letter b) GDPR. In addition, the data subject has the right to object to the processing of personal data concerning him based on Art. 6 Para. 1 Subparagraph 1 Letter f) GDPR under Art. 21 Para. 1 Sentence 1 GDPR (cf. BeckOK DatenschutzR/Albers/Veit, GDPR Art. 6 Rn. 66). Given that no special formal requirements apply to the information covered by Art. 13 and 14 GDPR (cf. BeckOK DatenschutzR/Schmidt-Wudy, GDPR Art. 13 para. 85 and GDPR Art. 14 para. 85), it is not relevant in the balancing of interests that the plaintiff, who has not substantiated that he has a smartphone, was not provided with the relevant information electronically by means of a push message.
17
b) Due to the legality of the transmission and the continued storage of the data, the plaintiff is also not entitled to a new determination of his score without taking into account the entry in dispute. In the absence of a claim in the main proceedings, the plaintiff is also not entitled to payment of the out-of-court costs incurred for legal proceedings and is not entitled to interest.
18
c) The appeal is not admissible because the requirements of Section 543 (2) of the Code of Civil Procedure are not met. Reasons within the meaning of Section 543 of the Code of Civil Procedure do not preclude the decision-making process. In particular, fundamental importance cannot be assumed because a referral to the Court of Justice of the European Union pursuant to Article 267 TFEU would be necessary in the appeal proceedings (cf. BGH, decision of November 3, 2022 - III ZR 308/20, BeckRS 2022, 33427 para. 2). There is also no case of divergence, since the Senate does not deviate from the known case law of the higher courts with its present decision. The decisive criterion in this respect is that - which is not the case here - the Senate's decision establishes an abstract legal principle that deviates from a - fundamental - abstract legal principle established in other decisions of a higher or equal court (cf. BGH, decision of January 23, 2018 - II ZR 73/16, BeckRS 2018, 9324, para. 10 with further references).
19
For the reasons set out above, the appeal has no prospect of success under any circumstances. The Senate therefore intends to reject the plaintiff's appeal in accordance with Section 522, Paragraph 2, Sentence 1 of the Code of Civil Procedure.
20
In the light of the facts, it is advisable to consider withdrawing the appeal within the above-mentioned deadline in order to avoid unnecessary further costs. In the event of withdrawal, the fee for the procedure is generally reduced from EUR 4.0 to EUR 2.0, in accordance with No. 1222 S. 2 KV to the GKG.
