OLG Schleswig - 17 U 5/22: Difference between revisions

From GDPRhub
No edit summary
 
(8 intermediate revisions by 2 users not shown)
Line 23: Line 23:
|Year=2022
|Year=2022


|GDPR_Article_1=Article 6(1)(f) GDPR
|GDPR_Article_1=Article 6(1)(e) GDPR
|GDPR_Article_Link_1=Article 6 GDPR#1f
|GDPR_Article_Link_1=Article 6 GDPR#1e
|GDPR_Article_2=Article 17(1)(c) GDPR
|GDPR_Article_2=Article 6(1)(f) GDPR
|GDPR_Article_Link_2=Article 17 GDPR#1c
|GDPR_Article_Link_2=Article 6 GDPR#1f
|GDPR_Article_3=Article 17(1)(d) GDPR
|GDPR_Article_3=Article 17(1)(d) GDPR
|GDPR_Article_Link_3=Article 17 GDPR#1d
|GDPR_Article_Link_3=Article 17 GDPR#1d
Line 66: Line 66:
}}
}}


The Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein) ruled that under current German law a credit rating agency may only lawfully process personal information from insolvency proceedings no later than six months after their termination.
The Higher Regional Court Schleswig-Holstein ruled that under current German law a credit rating agency may only lawfully process personal information from insolvency proceedings no later than six months after their termination.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
The controller is the SCHUFA Holding AG which is the biggest German credit rating agency.   
The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job.   


The dispute arose between the data subject and the SCHUFA Holding AG, which is the data controller and a German credit rating agency.
In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law -  on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject  was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate as laid down in the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), an internal policy of the association of the biggest German credit rating agencies ("Die Wirtschaftsauskunfteien e.V.").  
Insolvency proceedings were opened against the data subject that had been published - as required under German law -  on an insolvency notice portal (www.insolvenzbekanntmachungen.de). On March 25 2020, these proceedings had been terminated. § 3(1) of the German Insolvency Notification Regulation (InsoBekV) provides that these entries must be deleted no later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the notice portal. The controller, however, stored the information about the insolvency proceedings in their own database.  


As a result of the record of the controller, and after the deletion from the national insolvency notice portal, the data subject suffered severe economic consequences. It was not possible for him to switch his health insurance, rent an apartment or conduct business without prepayment. The data subject requested the deletion of his personal data from the SCHUFA records: on 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties. The controller refrained from deleting the records.
The data subject, consequently, filed a lawsuit against the controller before the Regional Court Kiel (Landgericht Kiel - LG Kiel) requesting the deletion of the record and the correction of his credit score in a way that the insolvency proceedings are no longer taken into account as a factor in the calculation. The LG Kiel dismissed the claim holding that the controller's and its customer's legitimate interest in knowing about the insolvency proceedings outweighs the interests of the data subject. The data subject then appealed this decision before the Higher Regional Court of Schleswig-Holstein (Oberlandesgericht Schleswig-Holstein - OLG Schleswig-Holstein).
 
The claim of the data subject for the deletion of the records had been dismissed on first instance by the LG Kiel. The data subject appealed the decision to the OLG Schleswig-Holstein.


=== Holding ===
=== Holding ===
The OLG Schleswig-Holstein held that the data subject was entitled to the right of erasure under [[Article 17 GDPR#1d|Article 17(1)(d) GPDR]], since the data processing of the controller was not lawful.  
The OLG Schleswig-Holstein set aside the judgement of the LG Kiel and upheld the claim. It found that the data subject was entitled to request the erasure of the record under [[Article 17 GDPR#1d|Article 17(1)(d) GPDR]] because the processing was unlawful.  


The only applicable legal basis for the processing at hand is [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] since the data subject neither consented to the processing nor can the activities of the controller be considered necessary for the performance of a task carried out in the public interest, as the OLG already clarified in [[OLG Schleswig - 17 U 15/21]].
First, the court determined that neither [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] nor [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] provide a legal basis for the processing because the data subject did not consent to the processing and the activities of the controller cannot be considered as necessary for the performance of a task carried out in the public interest. Regarding [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], the court referred to its previous decision ([[OLG Schleswig - 17 U 15/21]]) where it had already established that [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] is not a legal basis for the activities of a credit rating agency.
However, six months after the termination of an insolvency proceeding the data cannot be longer lawfully processed under [[Article 6 GDPR]] and the data subject may claim his the right to erasure under [[Article 17 GDPR#1a|Article 17(1)(a) GDPR]].  


''Balancing of interests''
Second, the court disagreed with the view of the LG Kiel that storing the information about the insolvency proceeds even after the six months period of § 3(1) InsoBekV had elapsed was lawful under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Here the court also referred to its previous decision [[OLG Schleswig - 17 U 15/21]], in which it found that a credit rating agency's interest sin storing the information longer than the six months period cannot be legitimate, because this would lead to a contradiction with the objective of § 3(1) InsoBekV and modern insolvency law to give the former insolvent debtor the possibility to a fresh start after the the insolvency proceedings had been terminated. However, the court explicitly stated that it does not take this approach this time and leaves the question open whether the interests of a credit rating agency are illegitimate only because of the aforementioned contradiction. The court rather took the approach to weigh the interests of the controller and the controller's customers against the interests of the data subject. it found that the interests of the data subject overrode the economic interest of the controller in having a comprehensive database, because storing the information about the insolvency proceedings did not only interfere with the data subject's right to informational self-determination and data protection, but also with his basic rights to self-expression, contractual freedom and to occupation. The court found that the letter rights were interfered with because - as admitted by the controller - insolvency proceedings and, consequently, also the storing of information about them typically results in economic consequences as described by the data subject. The court further found that the data subject's interests overrode the interests of the controller's customers. It disagreed with the view of the Higher Regional Courts of Cologne (Oberlandesgericht Köln - OLG Köln) and Oldenburg (Oberlandesgericht Oldenburg - OLG Oldenburg) that the "Rules of Conduct" are an appropriate point of reference for the balancing of interests, because they were drafted by a private association. It rather found that §3(1) InsoBekV constitutes an appropriate point of reference since it can be assumed that the maker of the ordinance - as a public body - considered and weighed the interests of all affected parties adequately. 


The OLG clarifies that the controller has a legitimate interest in storing information of insolvency proceedings for six months after the termination of the insolvency proceedings since it facilitates the defendant's work, makes it more effective and can strengthen its market position. After this period, the interest of the data subject outweigh the economic interest of the controller. The processing of the data at hand does not only violate the data subject's right to informational self-determination, but also other fundamental rights such as the right to freedom of action, the right to freedom of occupation, and the data subject's contractual freedom.
== Comment ==
The above mentioned decisions of the OLG Köln and OLG Oldenburg have the case numbers 15 U 153/21 and 13 U 63/21, respectively.


== Comment ==
The court also deviated  from its previous judgement [[OLG Schleswig - 17 U 15/21]] where it held that a balancing of interests with third party interests is only possible if the identity of the third party is already known, meaning that a third party had to have already requested the score or information about the data subject in question from the credit rating agency. The court held in the present judgement that also the typical interests of potentially affected parties can be balanced with each other under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]].
''Share your comments here!''


== Further Resources ==
== Further Resources ==

Latest revision as of 13:48, 28 June 2022

OLG Schleswig - 17 U 5/22
Courts logo1.png
Court: OLG Schleswig (Germany)
Jurisdiction: Germany
Relevant Law: Article 6(1)(e) GDPR
Article 6(1)(f) GDPR
Article 17(1)(d) GDPR
§ 3 InsoBekVO
Decided: 03.06.2022
Published:
Parties: SCHUFA Holding AG
National Case Number/Name: 17 U 5/22
European Case Law Identifier: ECLI:DE:OLGSH:2022:0603.17U5.22.00
Appeal from: LG Kiel (Germany)
10 O 127/21
Appeal to: Unknown
Original Language(s): German
Original Source: REWIS (in German)
Initial Contributor: n/a

The Higher Regional Court Schleswig-Holstein ruled that under current German law a credit rating agency may only lawfully process personal information from insolvency proceedings no later than six months after their termination.

English Summary

Facts

The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job.

In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate as laid down in the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), an internal policy of the association of the biggest German credit rating agencies ("Die Wirtschaftsauskunfteien e.V.").

The data subject, consequently, filed a lawsuit against the controller before the Regional Court Kiel (Landgericht Kiel - LG Kiel) requesting the deletion of the record and the correction of his credit score in a way that the insolvency proceedings are no longer taken into account as a factor in the calculation. The LG Kiel dismissed the claim holding that the controller's and its customer's legitimate interest in knowing about the insolvency proceedings outweighs the interests of the data subject. The data subject then appealed this decision before the Higher Regional Court of Schleswig-Holstein (Oberlandesgericht Schleswig-Holstein - OLG Schleswig-Holstein).

Holding

The OLG Schleswig-Holstein set aside the judgement of the LG Kiel and upheld the claim. It found that the data subject was entitled to request the erasure of the record under Article 17(1)(d) GPDR because the processing was unlawful.

First, the court determined that neither Article 6(1)(a) GDPR nor Article 6(1)(e) GDPR provide a legal basis for the processing because the data subject did not consent to the processing and the activities of the controller cannot be considered as necessary for the performance of a task carried out in the public interest. Regarding Article 6(1)(e) GDPR, the court referred to its previous decision (OLG Schleswig - 17 U 15/21) where it had already established that Article 6(1)(e) GDPR is not a legal basis for the activities of a credit rating agency.

Second, the court disagreed with the view of the LG Kiel that storing the information about the insolvency proceeds even after the six months period of § 3(1) InsoBekV had elapsed was lawful under Article 6(1)(f) GDPR. Here the court also referred to its previous decision OLG Schleswig - 17 U 15/21, in which it found that a credit rating agency's interest sin storing the information longer than the six months period cannot be legitimate, because this would lead to a contradiction with the objective of § 3(1) InsoBekV and modern insolvency law to give the former insolvent debtor the possibility to a fresh start after the the insolvency proceedings had been terminated. However, the court explicitly stated that it does not take this approach this time and leaves the question open whether the interests of a credit rating agency are illegitimate only because of the aforementioned contradiction. The court rather took the approach to weigh the interests of the controller and the controller's customers against the interests of the data subject. it found that the interests of the data subject overrode the economic interest of the controller in having a comprehensive database, because storing the information about the insolvency proceedings did not only interfere with the data subject's right to informational self-determination and data protection, but also with his basic rights to self-expression, contractual freedom and to occupation. The court found that the letter rights were interfered with because - as admitted by the controller - insolvency proceedings and, consequently, also the storing of information about them typically results in economic consequences as described by the data subject. The court further found that the data subject's interests overrode the interests of the controller's customers. It disagreed with the view of the Higher Regional Courts of Cologne (Oberlandesgericht Köln - OLG Köln) and Oldenburg (Oberlandesgericht Oldenburg - OLG Oldenburg) that the "Rules of Conduct" are an appropriate point of reference for the balancing of interests, because they were drafted by a private association. It rather found that §3(1) InsoBekV constitutes an appropriate point of reference since it can be assumed that the maker of the ordinance - as a public body - considered and weighed the interests of all affected parties adequately.

Comment

The above mentioned decisions of the OLG Köln and OLG Oldenburg have the case numbers 15 U 153/21 and 13 U 63/21, respectively.

The court also deviated from its previous judgement OLG Schleswig - 17 U 15/21 where it held that a balancing of interests with third party interests is only possible if the identity of the third party is already known, meaning that a third party had to have already requested the score or information about the data subject in question from the credit rating agency. The court held in the present judgement that also the typical interests of potentially affected parties can be balanced with each other under Article 6(1)(f) GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

36,399
|
Total areas of law

1,358
|
Employment Law

680
|
banking law

1,941
|
building rights

158
|
right of inheritance

202
|
European law

520
|
family law

3,664
|
commercial and corporate law

227
|
bankruptcy law

1,610
|
IT and media law

933
|
Cost and fee law

1,895
|
medical law

388
|
Tenancy and home ownership law

2,733
|
social law

2,756
|
state and constitutional law

755
|
tax law

1,588
|
criminal law

5,531
|
environmental law

965
|
traffic law

514
|
insurance law

23,446
|
administrative law

257
|
Competition and Intellectual Property Law

2.144
|
Civil and Civil Procedure Law

452
|
Other