VGH München - 4 ZB 23.1056
From GDPRhub
| VGH München - 4 ZB 23.1056 | |
|---|---|
 | |
| Court: | VGH München (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(e) GDPR Article 6(3) GDPR Article 21(1) GDPR Article 24(4) Municipal Code of the Free State of Bavaria |
| Decided: | 04.09.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 4 ZB 23.1056 |
| European Case Law Identifier: | |
| Appeal from: | VG Bayreuth B 4 K 21.694 |
| Appeal to: | Appealed - Overturned |
| Original Language(s): | German |
| Original Source: | Bayern.Recht (in German) |
| Initial Contributor: | Lacrosse |
The Munich Superior Administrative Court (Bayerischer Verwaltungsgerichtshof - VGH) held that the right to object under Article 21(1) GDPR does not apply to preparatory measures for the installation of electronic water meters, as this does not constitute processing of personal data.
English Summary
Facts
The data subjects in this case are co-owners of a property with two residential units with a total of six residents. A water meter was installed inside their house in order to record the property's total water consumption. The calibration validity of the water meter expired in 2020. The controller is a municipal special purpose association that operates a public water supply system. The association committee decided in 2019 to replace installed analog water meters with electronic water meters equipped with radio modules - which can be read remotely. This should have taken place in 2021 as part of the regular exchange of water meters.
The municipal special purpose association informed the complainants about the expiration of the calibration period and the intended replacement of the water meter. The data subjects denied access to their property and objected to the installation of an electronic water meter with a radio module, making reference to their right to objection under Article 21(1) GDPR. With a notice, the controller obliged the data subjects to grant one of his employees access to the water meter, stating that in case of non-fulfillment they would impose a fine. The controller submitted that, among others, the requirements for an objection under the GDPR were not given in this case. The data subjects, however, continued to refuse access to their property and filed a lawsuit against the controller's decision for violation of their fundamental and privacy rights.
The Administrative Court Bayreuth (VG Bayreuth) held that the notice of the municipal special purpose association was based on the statutes governing the public water supply facility. The installation of electronic water meters did not violate their fundamental rights to informational self-determination or to inviolability of the home, included in the Constitution of the Federal Republic of Germany. It also did not violate the provisions of the GDPR. For these reasons, the VG dismissed the case.
Consequently, the complainants decided to file an appeal against this judgment with the Munich VGH.
Holding
The Munich VGH held that water consumption volumes recorded with such electronic water meters may, under certain circumstances, constitute residents' personal data. That is the case, for instance, when these allow for the analysis of perosnal consumption habits of a data subject. However, in this case, the legislature had expressly permitted the use of electronic water meters with radio modules in Article 24(4) of the Municipal Code of the Free State of Bavaria. Thus, the VGH held that the supply of drinking water through the use of water meters, as a task in the public interest, constitutes lawful processing of personal data on the basis of Article 6(1)(e) GDPR, and the requirement of Article 6(3)(b) GDPR was satisfied, too. Also, the VGH held it to be proportionate to the aim pursued to switch from analog to remote water meters, as it allowed to improve the quality of consumption measurements overall.
Moreover, the VGH clarified that the right to object under Article 21(1) GDPR, refers to the processing of the objector's personal data. In the case at hand, the mere preparatory measures to the use of a water meter, such as the installation thereof does not constitute processing of personal data.
Hence, the VGH dismissed the appeal as it had no serious doubts about the correctness of the appealed administrative court ruling.
Comment
The appealed administrative court ruling (VG Bayreuth) is not available online. See: https://dejure.org/dienste/vernetzung/rechtsprechung?Gericht=VG%20Bayreuth&Datum=29.03.2023&Aktenzeichen=B%204%20K%2021.694
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
VGH Munich, decision of. 09/04/2023 – 4 ZB 23.1056 Title: Toleration order from the municipal water supplier, installation of a remotely readable water meter, consumption recording as processing of personal data, obligation to protect against unauthorized access by third parties, possibility of alternative methods of consumption recording, right of objection under state and Union law Norm chains: GO Art. 24 Paragraph 4 GG Art. 1 Paragraph 1; Article 2 paragraph 1 GDPR Art. 6 Paragraph 1 Sentence 1 Letter e; Article 18 paragraph 1 letter d; Article 21 paragraph 1 Tags: Toleration order from the municipal water supplier, installation of a remotely readable water meter, consumption recording as processing of personal data, obligation to protect against unauthorized access by third parties, possibility of alternative methods of consumption recording, right of objection under state and Union law Lower court: VG Bayreuth, judgment of March 29, 2023 – B 4 K 21,694 Location: BeckRS 2023, 26263 tenor I. The application for leave to appeal is rejected. II. The plaintiffs bear the costs of the approval procedure as joint and several debtors. III. The amount in dispute for the admission procedure is set at 5,000 euros. reasons I 1 The plaintiffs object to the obligation to grant the defendant access to the water meter to inspect and replace it and to allow them to enter their property for this purpose, as well as accompanying orders. 2 The plaintiffs are co-owners of a house property with two residential units, which they live in with their two children and the parents of the first plaintiff. The water meter in the house, which records the property's total consumption, was installed on March 24, 2014; its calibration validity was six years. 3 The defendant, a municipal special-purpose association, operates a public water supply facility on the basis of a water supply statute (WAS). On November 6, 2019, its association committee decided to install electronic water meters with a radio module as part of the regular replacement of water meters from 2021. 4 After the defendant informed the first plaintiff about the need to replace the water meter with an electronic water meter with remote reading due to the expiry of the calibration period, the first plaintiff denied one of the defendant's employees access to the water meter because she refused to install an electronic water meter. In a letter from their authorized representatives, the plaintiffs objected to an installation date planned by the defendant and at the same time objected to the installation of such a water meter with a radio module in accordance with Article 21 (1) GDPR. 5 By decision of May 12, 2021, the defendant obliged the plaintiffs to grant a representative of the defendant access to their water meter on June 9, 2021 at 10:00 a.m. to inspect and, if necessary, replace their water meter and to enter their property, their home and to tolerate their living spaces to the extent necessary (No. 1). The decision ordered the immediate execution of No. 1 (No. 2). In the event of non-fulfillment of the obligation to tolerate as set out in No. 1, it was determined that the violator would be liable for a penalty payment of 150 euros (No. 3). The costs of the proceedings were awarded to the plaintiffs (No. 4); A fee of 80 euros was set for the decision and expenses of 5.66 euros were levied (No. 5). The reason given was, among other things, that the legal requirements for a right to object did not exist. 6 After the defendant's employees were denied access on the set date, the plaintiffs filed a lawsuit against the decision on the day after next with the request to annul paragraphs 1 and 3 to 5 of the decision of May 12, 2021, as far as the As regards the installation of an electronic water meter with a radio function, the alternative is to state that paragraphs 1 and 3 to 5 of the decision of May 12, 2021 were unlawful as far as the installation of an electronic water meter with a radio function was concerned. 7 The defendant requested dismissal of the action. In another letter dated July 15, 2021, she rejected the plaintiffs' objection under Article 21 (1) GDPR against the operation of an electronic water meter with a radio module. 8th The administrative court rejected an application submitted by the plaintiffs for interim legal protection (ref. B 4 S 21.693) in its decision of August 4, 2021; The Bavarian Administrative Court rejected the complaint filed against it in a decision of March 7, 2022 (ref. 4 CS 21.2254). 9 With a ruling of March 29, 2023, the administrative court dismissed the lawsuit. The order in No. 1 of the decision is based on Section 25 Paragraph 1 of the statutes on the public water supply facility of the special purpose association (water delivery statutes - WAS), which is based on Art. 22 Paragraph 2 KommZG, Art. 24 GO. The association committee's decision to install electronic water meters with a radio module was reflected in Section 19a WAS, which is based on the special authorization basis of Article 24 Paragraph 4 Sentence 1 GO. The installation of such water meters with an activated radio module does not violate the right to informational self-determination under Article 2 Paragraph 1 in conjunction with Article 1 Paragraph 1 GG or Articles 100, 101 BV nor against the provisions of the General Data Protection Regulation. 10 According to the audit note, the plaintiffs submitted an application for permission to appeal against the judgment in a written document from their representatives that was sent as an electronic document at 11:23 p.m. on June 7, 2023. 11 The defendant opposes the application for admission. 12 Please refer to the court and administrative files for further details. II. 13 1. The application for admission of appeal remains unsuccessful because none of the reasons for admission asserted exist. 14 a) There are no serious doubts about the correctness of the administrative court judgment (Section 124 Paragraph 2 No. 1 VwGO). The plaintiffs have not questioned any single fundamental legal principle or significant factual findings of the administrative court with conclusive counterarguments (on this standard BVerfG, B.v. June 18, 2019 - 1 BvR 587/17 - BVerfGE 151, 173 Rn. 32 with further references). 15 aa) The plaintiffs argue that the contested order violates their fundamental rights to informational self-determination and the inviolability of the home. The fact that six people lived in a family relationship in the house, spread over two residential units, does not change the personal nature of the data. Consumption could be recorded with longer radio intervals or using a completely different technology; the principle of data economy is being violated. According to the defendant's explanations, it is not clear why a continuous spark is necessary in order to carry out an accounting once a year. The precautionary storage of data without cause is incompatible with European law and the case law of the Federal Constitutional Court. There is another technical system that uses the mobile phone network to access the data without driving and only when necessary. The continuous monitoring of consumption by radio is not covered by the authorization to issue the tax statute. There are technical alternatives that are more data-friendly, e.g. wired or that can be activated by the users themselves, which are also proportionate since the plaintiffs have always fulfilled their obligation to transmit the meter readings in a timely manner. Since these are not devices certified by the Federal Office for Information Security (BSI), manipulation cannot be ruled out with almost certainty. It is well known that the keys are easily available in stores, including on the Internet; Abuse by the defendant's employees cannot be ruled out either. If you have the key, your presence can be determined and the specific quantity of water used can be read out. The collection of data to localize leaks can also be done via video inspection of public sewers. Because radio readings only take place once a year, leaks would only be detected after months, so the radio function cannot be justified. The administrative court also wrongly assumed that it was a matter of connecting several units to one meter within the meaning of Article 24 Paragraph 4 Sentence 7 GO. Only when there is a minimum number of residents at a common meter can the personal reference be eliminated; This should be clarified regardless of the number of residential units. The order is also erroneous in its discretion because the threat of a penalty payment is disproportionate to the purpose of the reading, which the plaintiffs never refused to do. Furthermore, the order should not have been issued before a decision had been made on the plaintiff's objection in accordance with Article 21 (1) GDPR. 16 bb) These statements are not suitable to raise serious doubts about the correctness of the first instance judgment. 17 (1) Contrary to the plaintiffs' allegations, the use of electronic water meters with radio function, which is expressly permitted by the legislature under certain conditions in accordance with Article 24 Paragraph 4 of the GO, does not constitute a violation of the fundamental housing rights (cf. BayVerfGH, E.v. April 26, 2022 - Vf. 5 -VII-19 – BayVBl 2022, 475 Rn. 64 ff.) is still an inadmissible interference with the fundamental right to informational self-determination. The consumption quantities recorded with such (radio) water meters - just like the quantities recorded with conventional meters - can represent personal data of the residents of the property in question if and to the extent that conclusions can be drawn from them about the individual consumption behavior of individual people (cf. BayVGH, B.v. March 7, 2022 – 4 CS 21.2254 – BayVBl 2022, 412 Rn. 27 with further references). Even when used together by several people, if water consumption is recorded continuously, it may be possible to draw conclusions about the consumption habits of individuals with little additional knowledge (cf. Swiss Federal Court, U.v. 5.1.2021 - 1C_273/2020 - EuGRZ 2021, 228 juris Rn . 36). However, the processing of personal data within the meaning of Art. 4 No. 2 GDPR, which is present in certain case constellations, is lawful - even without consent according to Art. 4 No. 11 GDPR - in accordance with Art. 6 Para. 1 Sentence 1 Letter e GDPR, if it is necessary for the performance of a task in the public interest such as drinking water supply. The Bavarian legislature has created the legal basis necessary for this in accordance with Article 6 Paragraph 3 Sentence 1 Letter b of the GDPR with the special regulation for the use and operation of such water meters contained in Article 24 Paragraph 4 Sentence 1 GO (cf. LT-Drs. 17 /19628 p. 56). 18 The aforementioned statutory authorization, which applies to water supply facilities with compulsory connection and use, satisfies the Union law requirements of Art. The right to informational self-determination is protected by Art. 1 Paragraph 1 of the Basic Law. The legal intervention related to the processing of personal data pursues a legitimate purpose. By operating water meters, the water supply facilities operated for reasons of public welfare (Art. 24 Para. 1 No. 2 GO) fulfill their obligations under Section 18 Para. 1 and 2, Section 35 AVBWasserV (V.v. June 20, 1980, BGBl I p. 750 ) the following obligation to determine the amounts of water used by customers using functioning measuring devices. 19 (2) The facility owners are not prohibited from using electronic consumption recording devices with remote reading because they do not require certification by the BSI. Regardless of this, the water suppliers are responsible for compliance with the general security requirements in accordance with Article 5 Paragraph 1 Letter f and Article 32 GDPR. Before using electronic radio water meters, you must therefore ensure that the stored and transmitted data is adequately protected from access by unauthorized third parties through suitable technical and organizational measures (LT-Drs. 17/19804 p. 2). The plaintiffs have not comprehensibly demonstrated that the necessary security against unauthorized access by third parties would not be guaranteed, especially for the devices used by the defendant. They have not provided any evidence to support their claim that the individual keys for each of the meters needed to decode the reading data on the reading devices are readily available in stores or on the Internet; There is also no evidence of such a failure of the complex encryption technology. The plaintiffs also did not explain in more detail to what extent there is a risk of misuse of the collected data by the defendant's employees, which is not just theoretical; Furthermore, it is not clear to what extent this should result in an argument against the use of a digital instead of an analogue water meter. 20 The switch from analogue water meters that can only be read on site to remotely readable devices, with which, in addition to water consumption, other information such as water flow or water temperature can be recorded, stored and transmitted electronically, is suitable for the efficient and resource-saving fulfillment of public supply tasks. In particular, it serves to reduce the personnel effort required to accurately determine consumption and to detect technical defects that can lead to leaks in the pipe network or risks to drinking water hygiene earlier and more accurately (BayVGH, B.v. March 7, 2022, a.a.O., Rn. 31 m.w.N. ). According to Article 24 Paragraph 4 Sentence 2 GO, only data that is necessary to fulfill the mandatory task of water supply and to ensure the operational safety and hygiene of the entire water supply facility may be stored and processed in an electronic water meter. Contrary to the plaintiffs' assessment, this is not a case of precautionary storage of data for no reason - which is inadmissible under EU and constitutional law. 21 (3) The objection that consumption recording could be carried out with longer radio intervals or using a completely different technology cannot be accepted; A video inspection of public sewers is sufficient to locate leaks. As the defendant clearly explained, an extension of the radio intervals for 9,000 affected water meters would make it impossible to drive on the local roads, as the radio times of the water meters would have to be coordinated within the reading routes. Short radio intervals are also necessary for the rapid localization of damage as part of event-related interim readings in accordance with Article 24 Para. 4 Sentence 3 No. 2 GO; Leaks can therefore be detected immediately and not only during the annual consumption reading. It goes without saying that possible damage to the water pipe network cannot be determined equally well using the video inspections of the public (sewer) sewers mentioned by the plaintiffs as an alternative. 22 As the administrative court convincingly explained, the defendant cannot be referred to an equally effective but less intrusive method of consumption recording and technical control in order to achieve its goals. Bidirectional devices, which are only triggered to send data packets when activated from outside (“on demand”), are less suitable for displaying disruptions in the line network and also pose additional risks with regard to data security. The same applies to radio modules that can only be activated by the connection recipients. Since no equivalent and practical alternative to the devices used by the defendant can be identified, this does not violate the EU law requirement of data economy or data minimization (Art. 5 Para. 1 Letter c GDPR). 23 (4) The administrative court rightly assumed that the plaintiffs could not make use of the state law right to object in accordance with Article 24 Paragraph 4 Sentence 5 to 7 GO. According to Article 24 Paragraph 5 Sentence 7 of the GO, such a right of objection does not exist if several units in a supplied property have a common water meter. The administrative court clearly explained that this was the case at the relevant time of the contested decision, with reference to the information provided by plaintiff 1 in the oral hearing and to the special ownership of the apartments. The plaintiffs' assumption that instead of the number of residential units it is the number of residents supplied by a common meter that is important is not supported in the wording of the law. The determining factor as to whether there are “several units” is not the individual usage conditions - which are subject to frequent changes and can hardly be verified by outsiders - but rather solely the structural situation (cf. BayVGH, B.v. March 7, 2022 - 4 CS 21.2254 - Rn. 35) . 24 The fact that the objection raised by the plaintiffs (additionally) in accordance with Article 21 of the GDPR had not yet been decided upon when the contested decision was issued also does not conflict with its legality. The challenged order only concerned the obligation to allow entry to the plaintiffs' property and the replacement of the water meter. The right to object according to Article 21 Para. 1 GDPR, on the other hand, refers to the processing of the objector's personal data; This does not cover mere preparatory measures such as the installation of technical equipment. An objection that has been lodged and not yet decided upon does not have any legal suspensory effect with regard to the data processing in question; It is therefore the responsibility of the person concerned to seek interim legal protection in order to enforce their claim under Article 18 Paragraph 1 Letter d GDPR. 25 (5) Contrary to the plaintiffs' submission, the contested order, which threatened a fine in the event of non-compliance, was not erroneous in its discretion because the plaintiffs never refused to have their water consumption read. The subject of the order was not a meter reading, but rather the granting of access to the premises in which the water meter was located and the toleration of the replacement with a remotely readable electronic meter. It is not clear that a less stressful means than the threat of a fine would have been considered to enforce this legally required behavior or that the fine of 150 euros would have been unreasonably high. 26 b) An appeal against the judgment of the administrative court is not to be permitted because the case would present particular factual or legal difficulties (Section 124 Para. 2 No. 2 VwGO). 27 The “burden of proof questions with regard to the objection pursuant to Article 21 Paragraph 1 of the GDPR”, which the plaintiffs only generally describe, cannot arise in the present case because, as explained above, the aforementioned right to object only relates to the processing of personal data that is not the subject of the dispute . The decision on the objection is not the subject of the present proceedings, so the burden of proof on the defendant is irrelevant. 28 The plaintiffs' objection that the decision of the Bavarian Constitutional Court of April 24, 2022 (BayVBl 2022, 475), with which a popular lawsuit on Article 24 Paragraph 4 GO was rejected, still leaves room for maneuver or contains a need for clarification under simple law is largely unsubstantiated. Insofar as the question is raised (again) in this context as to the number of people in a household above which re-anonymization is no longer possible, it is overlooked that the legal and statutory bases for the installation of remotely readable water meters do not require that this is not the case under any circumstances Collection or processing of personal data may occur. 29 The plaintiffs' claim that it is not clear how long the collected data can be stored locally is obviously incorrect. Rather, the defendant's water tax statutes contain precise deadlines in Section 19a, Paragraph 2, Sentence 2. 30 2. The decision on costs follows from Section 154 Paragraph 2 in conjunction with Section 159 Sentence 2 VwGO; The determination of the amount in dispute is based on Section 47 Paragraph 3 and Section 52 Paragraph 2 GKG. 31 This decision is irrevocable (Section 152 Paragraph 1 VwGO). If the application is rejected, the decision of the administrative court becomes final (Section 124a Paragraph 5 Sentence 4 VwGO).
