OVG Saarlouis - 2 A 355/19
| OVG Saarland - 2 A 355/19 | |
|---|---|
 | |
| Court: | OVG Saarland (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7(1) GDPR § 7(2) of the national German law against unfair competition (UWG) |
| Decided: | 16.02.2021 |
| Published: | 16.02.2021 |
| Parties: | Data protection authority of Saarland (defendant) Insurance, asset management and financing company (plaintiff) Spouses as petitioners before the data protection authority |
| National Case Number/Name: | 2 A 355/19 |
| European Case Law Identifier: | ECLI:DE:OVGSL:2021:0216.2A355.19. |
| Appeal from: | VG Saarlouis (Germany) 1 K 732/19 |
| Appeal to: | Unknown |
| Original Language(s): | German German |
| Original Source: | Rechtsprechungsdatenbank Saarland (in German) Rechtsprechungsdatenbank Saarland (in German) |
| Initial Contributor: | Maïlys Lemaître |
The superior administrative court of Saarland (OVG Saarlouis) underlined the conditions for consent in the context of direct marketing purposes and the requirements that can result from competition law in this regard.
English Summary
Facts
Following the complaint of two petitioners claiming that the plaintiff had contacted them for direct marketing purposes, even though they had not consented to the processing of their personal data to this effect, the supervisory authority for data protection in Saarland, the defendant, ordered a limitation of the processing and an erasure of the unlawfully processed personal data of the petitioners by the plaintiff pursuant to Article 58(2)(f) and Article 58(2)(g) GDPR.
The plaintiff had not been able to prove that the consent of the petitioners had been obtained in accordance with the requirements of Article 7(1) GDPR. The argument presented by the company, alleging that the petitioners' consent had been collected at the time of their participation in a lottery and confirmed via e-mail as part of a so called "double opt-in process", were not considered sufficient by the supervisory authority. The authority pointed out that the plaintiff should have been able to prove that the consent actually originated from the person contacted for direct marketing purposes, which had not been the case in the present matter. Furthermore, the authority underlined that the plaintiff could not justify a legitimate interest pursuant to Article 6(1)(f) GDPR, which would allow them to process the petitioners' data without their consent, the petitioners not having any business relationship with the plaintiff and therefore no reasonable expectation to be contacted by the plaintiff's company. In this context, contacting the petitioners for direct marketing purposes without their prior consent even qualified as unreasonable harassment under § 7(2)(2) of the national competition law (UWG).
The plaintiff appealed the decision of the supervisory authority before the administrative court of Saarland (VG Saarlouis), arguing amongst other things that the orders could only be considered contradictory because of the reference to requirements from data protection as well as competition laws which could not apply concurrently. The administrative court dismissed the appeal, whereupon the plaintiff appealed to the OVG Saarlouis for a reassessment of the case.
Dispute
1) To which extent is the data controller obligated to demonstrate the obtaining of the data subject's consent pursuant to Article 7(1) GDPR?
2) Can the requirements resulting from competition law be applied for assessing if a consent to direct marketing is valid?
3) Can the data processing for direct marketing purposes alternatively be based on legitimate interest in accordance with Article 6(1)(f) GDPR when no valid consent has been obtained?
Holding
The OVG Saarlouis also dismissed the appeal of the plaintiff arguing as follows:
1) The plaintiff did not succeed in proving that the petitioners had consented to the processing of their personal data pursuant to Article 7(1) GDPR, since no connection could be made between them and a possible consent of theirs. The inability to prove the existence of consent therefore made the processing of data on its basis unlawful. The supervisory authority was therefore legitimate to order a limitation of the processing and an erasure of the unlawfully processed data in accordance with Article 58(2)(f) and Article 58(2)(g) GDPR.
2) There is no contradiction in concurrently referring to the legal basis under data protection law and the requirement on opt-in resulting from § 7 UWG. The court sees no reason why the assessment under data protection law should differ from the assessment under competition law, both aiming to protect the consumer against abuse. Thus, it is also necessary from the point of view of material correctness to apply both areas of regulation without them necessarily contradicting one another. The supervisory authority and administrative court were therefore right to refer to both laws in this matter.
3) Even if, as the plaintiff argued, a recourse to Article 6(1)(f) GDPR were to be considered as an alternative because of the lack of consent by the data subject, the plaintiff's interest would automatically be illegitimate because of the unlawfulness of the processing with regard to requirements from competition law. As a result, the administrative court had been right in confirming that the legal basis of Article 6(1)(f) GDPR was no possible alternative option to consent.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
