VG Düsseldorf - 29 K 3117/22
From GDPRhub
| VG Düsseldorf - 29 K 3117/22 | |
|---|---|
 | |
| Court: | VG Düsseldorf (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5 GDPR Article 58 GDPR |
| Decided: | 16.01.2025 |
| Published: | |
| Parties: | Data Controller (entity responsible for reporting to SCHUFA) |
| National Case Number/Name: | 29 K 3117/22 |
| European Case Law Identifier: | ECLI:EN:VGD:2022:0116.29K3117.22.00 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Justice Portal North Rhine-Westphalia (in German) |
| Initial Contributor: | Shravan |
A court upheld a DPA's warning regarding a bank's failure to provide accurate debtor's data to a credit scoring agency. The court found violations of accuracy and accountability under Articles 5(1)(d) and 5(2).
English Summary
Facts
The controller, a major private bank, failed to properly report a data subject's loan settlement to SCHUFA. Despite the data subject making regular payments, the controller’s automated system did not record them correctly, resulting in inaccurate reports being sent to SCHUFA.
Following a complaint, the DPA issued a warning against the controller for violating Article 5(1)(d) GDPR, which mandates accurate data processing. The controller argued that the violation occurred before the GDPR came into effect, thus it should not apply. Even if applicable, the controller contended that it had taken appropriate corrective actions and that its automated system should not be held accountable for the errors.
The controller seeks to have the warning lifted, while the DPA maintains that the controller’s failure to ensure accurate reporting violates the GDPR.
Holding
The court held that the DPA’s warning against the controller was justified.
It found that the controller failed to ensure the accuracy of the personal data transmitted to SCHUFA, as required by the GDPR. The court emphasized that under Article 5(1)(d) GDPR, personal data must be accurate and kept up to date. The controller continued to report inaccurate balance information to SCHUFA after the debt was settled in February 2018, violating the data accuracy requirement.
The court noted that while the controller may have processed the data with a legitimate interest, the failure to correct inaccuracies in the data subject’s data within a reasonable time violated the principle of data accuracy. The controller did not demonstrate sufficient efforts to correct or delete the incorrect data after the debt was settled, which violated Article 5(2) GDPR (accountability principle) as well.
While the DPA could have imposed a fine under Article 83 GDPR, the court found that the DPA’s decision to issue a warning instead was proportionate to the violation pursuant to Article 58(2)(b) GDPR.
As a result, the court upheld the DPA’s warning, finding that the controller had not complied with their obligations under the GDPR in ensuring the accuracy of personal data and did not demonstrate proper accountability for the data processing.
Comment
An interesting aspect of this case is the emphasis on the accountability principle (Article 5(2)) and the controller’s failure to correct inaccurate data. The court also highlighted the proportionality of issuing a warning rather than a fine under Article 58(2)(b), emphasizing the responsibility of data controllers to ensure data accuracy.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Administrative Court Düsseldorf, 29 K 3117/22
date:
16.01.2025
Court:
Administrative Court of Düsseldorf
Saying body:
29. Chamber
Decision type:
Judgment
File number:
29 K 3117/22
ECLI:
ECLI:EN:VGD:2022:0116.29K3117.22.00
Tenor:
The lawsuit is dismissed.
The applicant shall bear the costs of the proceedings.
The judgment is provisionally enforceable because of the costs. The plaintiff may avert enforcement by providing security in the amount of 110% of the amount enforceable on the basis of the judgment, unless the defendant provides security in the amount of 110% of the amount to be enforced before enforcement.
1
Facts
2
The plaintiff is part of the G. A. Group, the largest private bank in C., with headquarters in B.. It opposes a data protection warning of the defendant supervisory authority.
3
As part of its business activities, the plaintiff grants consumer loans. For cases in which debtors do not meet their obligations under the loan relationship, it maintains a receivables management department, the so-called "Collection Business Unit" (CBU). This has its own computer system, in which all disturbed obligations are created. When a debt relationship is transferred into the CBU system, it is provided with a key in the plaintiff's core banking system, so that postings there are also reported to the CBU system. The CBU system is technically responsible for reporting outstanding balances to the SCHUFA. However, the system does not make an immediate completed notification to the SCHUFA if a balance is zero. Rather, the plaintiff, for its part, reports to the debt collection agency responsible for debt collection that the claim has been settled. The latter checks the existence of other rights and obligations from the underlying contractual relationship and then reports back to the plaintiff via a weekly list that the claim has been settled. After receipt of the list in the CBU system, this automatically makes the completed notification to the SCHUFA.
4
In the context of a consumer loan agreement, a contract customer of the plaintiff, Mr. P., was in default with the service of his loan. After despite multiple reminders from the plaintiff, last time on 00. March 0000, no payment was made, she terminated the loan by letter of 00. April 0000. She then reported the loan relationship to the SCHUFA as terminated and commissioned the debt collection company T. previously X. Deutschland GmbH, with the collection of the claim. The debt collection company closed on 0. May 0000 an installment payment agreement of 750.00 euros with the debtor, whereupon the latter on the 6. June 2017, 19. July 2017, 24. August 2017, 4. October 2017, 23. October 2017, 13. December 2017, 5. January 2018, 8. January 2018, 12. January 2018, 25. January 2018 and 14. February 2018 made cash deposits to service the installment payment agreement. Unlike in the standard process, the plaintiff's branch employee who received the payments did not manually post them with a corresponding key, but simply made a deposit into the account. As a result, the core banking system could not report the cash deposits to the CBU system. The CBU system then transmitted on 15. October 2017, 12. November 2017, 10. December 2017 and 14. January 2018 regular balances to the SCHUFA, which had not taken the payments into account.
5
On the debtor's complaint, the plaintiff corrected the incorrect balance and issued the remaining amount owed in the amount of EUR 357.69. On the 20th In February 2018, she reported the settlement of the outstanding claim to the debt collection company. The latter subsequently determined the completion of the installment payment agreement, but failed to note the completion in the weekly list provided for this purpose. After the CBU system did not receive a settlement report and as a result considered the claim disturbed, it continued to report outstanding balances to the SCHUFA, among other things on the 10th. June 2018 (358 Euro), 16. July 2018 (359 Euro), 12. August 2018 (359 Euro), 16. September 2018 (359 Euro) and 14. October 2018 (360 Euro).
6
On 31. October 2018, the plaintiff reported the claim for a new appeal by the debtor retroactively from 11 October 2018. February 2018 as done. On 26. In November 2020, she also submitted a deletion application to the SCHUFA. In the context of the supervisory proceedings, it admitted to the defendant, inter alia, in its statements of 15. October 2020, 5. May 2021, 23. June 2021, 15. November 2021 and 21. February 2022 Error in the transmission of balance reports to the SCHUFA.
7
With decision of 00. On March , 0000, the defendant warned the plaintiff on the basis of Art. 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27. April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation (GDPR). By repeatedly reporting false to the SCHUFA, the SCHUFA had at least negligently violated Art. 5 para. 1 d GDPR. If the general duty of care was observed, the plaintiff should have recognized that false reports could lead to problems with the SCHUFA information as well as with the score value, which is important for a person's creditworthiness. Taking into account the fact that the plaintiff had corrected the incorrect SCHUFA reports, initiated a deletion of the data and waived the remaining amount of the claim, she was exceptionally only warned.
8
The plaintiff has on 00. In terms of formal terms, the required hearing was not made, since it had not been announced at any time the enactment of a specific administrative act. Moreover, the decision is not sufficiently determined. Through the overall reference to all statements in the administrative procedure, it is not clear which fact is the subject of the official disapproval.
9
In the merits, there is no basis for authorization for the contested administrative act. The facts to be assessed were no later than 11. February 2018 and thus before the General Data Protection Regulation came into force. This also applies to the no-done report. Due to the constitutional prohibition of retroactive effect, an application of the General Data Protection Regulation is thus excluded.
10
Even if one assumes that the regulation is applicable, there is no violation of Art. 5 (1) (d) GDPR. The principle of accuracy of this provision is not absolute. Rather, it is important to take all appropriate measures to eliminate an inaccuracy. It had fully met these requirements. In addition, a possible violation of data protection regulations could not be attributed to it, since the commissioned debt collection agency had acted on its own responsibility in the recovery of the claim. Insofar as the defendant now decisively relies on the lack of an internal system for controlling the processed data to justify its decision, it shall rely rely the grounds for its warning in an impermissible manner. Her arguments were also inaccurate in the merits, since she, the plaintiff, had a sufficient internal control system for the random verification of the clearance lists.
11
Moreover, the measure expressed is disproportionate. Since the process of reporting outstanding balances to the SCHUFA was completely automated, it had no possibility of recognizing or preventing the incorrect further reporting of an open balance. For the debtor, the failed settlement notification did not result in any difference to his SCHUFA score. Due to the retroactive deletion of the process at the SCHUFA, it was even better off.
12
The applicant requests,
13
the decision of the defendant of 00. March 0000 to be lifted.
14
The defendant requests,
15
dismiss the lawsuit.
16
In the justification, it states that in formal terms, neither a hearing of the plaintiff nor a further specification of the facts to be assessed was required. Already in the administrative proceedings, the plaintiff had explained that she had made mistakes in the context of the SCHUFA reports. If it has been able to observe the duties of care incumbent on it, it had been able to recognize that the alleged data protection violation lied both in the incorrect SCHUFA reports and in the non-completed notification of the claim.
17
With regard to the applicability of the General Data Protection Regulation, a distinction must be made between the authority's authority to act and the underlying substantive law. While the question of the power of intervention is based on the law at the time of the official decision, the applicable substantive law must be based on the facts to be assessed, in this case on the omised notification of completion in October 2018.
18
As the creditor of the claim, the plaintiff is responsible for the false or omitted notification to the SCHUFA. It did not comply with its obligation to continuously check the "weekly list", but had relied exclusively on its automated processes. The extent to which the debtor is improved in the result by the retroactive deletion of his data at the SCHUFA is not decisive for a data protection violation. At most, the continuation of the risk resulting from the violation could be reduced by deleting it.
19
In the oral hearing, the defendant handed the plaintiff a hearing letter dated 00. January 0000, with which he has a comment period until 00. January 0000 was granted.
20
For further details of the facts and the dispute, reference is made to the content of the court file and the administrative procedure that was brought.
21
Reasons for decision
22
The lawsuit is not successful.
23
It is permissible. In particular, it is admissible as an action for appeal in accordance with § 42 para. 1 Alt. 1 Administrative Court Code (VwGO). The warning within the meaning of Art. 58 (2) (b) GDPR is a burdensome administrative act.
24
Cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 25; VG Mainz, judgment of 17. December 2020 – 1 K 778/19. MZ –, BeckRS 2020, 41220 Rn. 20; VG Hannover, judgment of 27. November 2019 – 10 A 820/19 –, BeckRS 2019, 31874 Rn. 17.
25
Although it does not create any obligations for the addressee to act, but a binding, disapproving determination is made on a specific data protection violation, which is to be qualified as an establishing administrative act.
26
See Polenz, in: Simitis/Hornung/Spiecker, Data Protection Law, GDPR, 2. Rel. 2025, Art. 58 Rn. 8.
27
By way of derogation from § 78 para. 1 no. 1 VwGO - the action is not against the state of North Rhine-Westphalia, but against the supervisory authority, i.e. the defendant, according to § 20 para. 5 sentence 1 no. 2 of the Federal Data Protection Act (BDSG).
28
Cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 27.
29
However, the complaint is unfounded.
30
The decision of the defendant of 00. March 0000 is lawful and does not violate the plaintiff's rights, cf. § 113 para. 1 sentence 1 VwGO.
31
The defendant's data protection warning has its legal basis in Art. 58 (2) (b) GDPR.
32
According to the settled case law of the Federal Administrative Court, the legal situation relevant for the judicial decision results from substantive law, from which not only the factual prerequisites of an authorization basis or a claim itself, but also the answer to the question at what point in time these conditions must be met can be obtained. The decisive matter is therefore which legal provisions apply to themselves, according to their intention to apply at the time of the decision for the assessment of the application, regardless of whether it is an action for assessment, an action for performance, an action for appeal or an action for obligations.
33
Cf. BVerwG, judgment of 2. March 2022 - 6 C 7/20 -, juris Rn. 24; judgment of 16. September 2020 – 6 C 10/19 –, juris Rn. 13.
34
In the case of intervention measures of an authority within the framework of which it is granted discretion, the judicial review refers to the time of the exercise of the discretion, if nothing to the material law makes a different.
35
Cf. BVerwG, judgment of 27. March 2019 - 6 C 2/18 -, juris Rn. 10; clarifying this BVerwG, judgment of 16. September 2020 – 6 C 10/19 –, juris Rn. 14.
36
According to this, the factual and legal situation at the time of the last administrative decision, so here the warning of 00. March 0000, to turn off. This is because the decision on a warning pursuant to Art. 58 (2) (b) GDPR is at the discretion of the supervisory authority.
37
Cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 141 m.w.N.
38
Nothing else does arise from substantive law. The General Data Protection Regulation does not indicate that data protection violations that occurred before they were in force would still be too modest under old law. Rather, it claims in accordance with Art. 99 (2) GDPR from the 25. May 2018 directly in all Member States.
39
Cf. on information claims BVerwG, judgment of 2. March 2022 - 6 C 7/20 -, juris Rn. 25.
40
Accordingly, the German data protection laws do not contain any transitional provisions.
41
See Art. 8 of the Act on the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and on the Implementation of Directive (EU) 2016/680 (Data Protection Adaptation and Implementation Act EU – DSAnpUG-EU), BGBl. I, 2097.
42
There are no formal concerns about the contested decision.
43
The defendant is responsible as the supervisory authority in accordance with § 40 para. 1 BDSG in conjunction with § 26 sentence 2 of the Data Protection Act North Rhine-Westphalia (DSG NRW) for issuing the warning. According to this, the monitoring of data processing by non-public bodies - one is the plaintiff as a legal entity under private law - within the scope of the GDPR falls within the area of responsibility of the authorities responsible under state law. According to Art. 56 (1) GDPR, the supervisory authority of the main establishment or sole establishment of the controller or processor is the competent supervisory authority. This is for North Rhine-Westphalia - the plaintiff has her main establishment in B. - according to § 26 DSG NRW the defendant.
44
Moreover, the requirements for the formal legality of the contested measure pursuant to Article 58(4) of the GDPR are governed by the law of the Member State concerned, which is to be applied and interpreted in accordance with the Charter of Fundamental Rights of the European Union and taking into account recital 129 of the GDPR.
45
VG Hannover, judgment of 27. November 2019 – 10 A 820/19 –, BeckRS 2019, 31874 Rn. 22.
46
There are no far-reaching legal concerns in this respect. It is true that the defendant did not hear the plaintiff in accordance with the requirements of § 28 (1) of the Administrative Procedure Act for the State of North Rhine-Westphalia (Administrative Procedure Act NRW - VwVfG NRW). However, the plaintiff cannot demand a cancellation of the administrative act, since the lack of hearing is irrelevant according to § 46 VwVfG NRW.
47
According to § 28 para. 1 VwVfG NRW, which in principle also applies to determining administrative acts, insofar as these - as here - have a burdensome effect on the person concerned,
48
cf. Schwarz, in: Fehling/Kastner/Störmer, Verwaltungsrecht, 5. Rel. 2021, § 28 Rn. 30,
49
is to give an interested party the opportunity to comment on the facts relevant to the decision before adopting an administrative act that interferes with his rights. This presupposes that the authority gives the person concerned the opportunity to comment on the course of the proceedings, the subject matter, the facts relevant to the decision and the possible outcome within a reasonable period of time.
50
See Ramsauer, in: Kopp/Ramsauer, VwVfG, 25. Rel. 2024, § 28 Rn. 12.
51
A proper hearing regularly includes the announcement that in a specific individual case the adoption of a specific administrative act is intended.
52
See Herrmann, in: BeckOK, VwVfG, Status: 1. October 2024, § 28 Rn. 15-16.1; Schneider, in: Schoch/Schneider, VwVfG, 4. EL 2023, § 28 Rn. 40.
53
Without the concretization of the intended official measure, the purpose pursued with the hearing of commenting on the facts relevant to the decision would come to nothing.
54
Cf. BVerwG, judgment of 22. March 2012 – 3 C 16/11 –, BeckRS 2012, 2823 Rn. 12.
55
The defendant did not meet these requirements, since it did not at any time give the applicant the prospect of enacting a specific administrative act. Although the letters addressed to the plaintiff partly contained – such as the letter of 17. September 2020 - References to the provisions of the GDPR ("supervision pursuant to Art. 58 of the European General Data Protection Regulation (Regulation (EU) 2016/679, here: DS-GVO)). However, the defendant did not specify which administrative act was intended in terms of type and content, so that the plaintiff could not recognize what she had to comment on and what decision she had to expect. However, a corresponding concretization would have been necessary, since Art. 58 (2) GDPR provides for different instruments for sanctioning a data protection violation.
56
The defendant was also not allowed to waive the hearing according to § 28 para. 2 VwVfG NRW, because it did not appear to be required under the circumstances of the individual case. Notwithstanding the existence of the requirements of the provision, it presupposes in any case that the competent authority determines on the fact side – which can be fully verified by the court – whether the hearing is necessary on the basis of the circumstances of the individual case, and then in a second step exercises discretion, whereby special attention to the principle of proportionality is required due to the exceptional nature of the provision.
57
Cf. BVerwG, judgment of 22. February 2022 - 4 A 7/20 -, BeckRS 2022, 12385 Rn 21. ; Schneider, in: Schoch/Schneider, VwVfG, 4. EL 2023, § 28 Rn. 53.
58
This did not happen here, since the defendant in its decision did not make the requirement of a hearing in accordance with § 28 (1) VwVfG NRW or the existence of an exception in accordance with paragraph 2 as the subject of its statements.
59
The lack of hearing is also not in accordance with § 45 para. 1 no. 3 VwVfG NRW has been cured.
60
According to this provision, a violation of procedural or formal regulations, which – as in this case – does not invoide the administrative act pursuant to § 44, is irrelevant if the required hearing of a party is made up for. According to paragraph 2 of the provision, acts referred to in paragraph 1 may be made up until the conclusion of the last factual instance of administrative proceedings.
61
A cure according to this provision presupposes that the hearing is subsequently carried out properly and its function for the decision-making process of the authority is achieved without restriction. This includes that the authority takes into account any arguments of the person concerned in its decision.
62
Cf. BVerwG, judgments of 22. February 2022 - 4 A 7/20 -, BeckRS 2022, 12385 Rn. 25 and from 22. March 2012 – 3 C 16/11 –, BeckRS 2012, 2823 Rn. 18, each m.w.N.
63
According to this, the lack of hearings has not been remedied. In particular, the defendant did not recure the required hearing by handing the plaintiff a hearing letter in the oral hearing before the Administrative Court. The opportunity granted to the applicant to comment was given with a deadline of 00. January 0000, so that she did not make use of her right to hear in the oral hearing. As a result, the defendant could not deal with any new arguments of the plaintiff, as required by § 45 (1) No. 3 VwVfG NRW.
64
However, the omissed hearing is irrelevant according to § 46 VwVfG NRW, so that the plaintiff cannot claim the cancellation of the administrative act.
65
According to § 46 VwVfG NRW, the annulment of an administrative act that is not void according to § 44 cannot be claimed solely because it came about in violation of provisions on the procedure, the form or the local jurisdiction, if it is obvious that the violation did not influence the decision on the merits.
66
There are no concerns regarding the applicability of the provision here. In particular, it allows the error to be inadged regardless of whether it is a bound decision or the authority is entitled to a margin of discretion or discretion in the decision.
67
See Schemmer, in: BeckOK, VwVfG, as of: 1. October 2024, § 46 Rn. 33; with reference to the history of the Schneider, in: Schoch/Schneider, VwVfG, 4. EL 2023, § 46 Rn. 2.
68
Even EU law does not prevent the use of § 46 VwVfG NRW here.
69
With a few exceptions, EU administrative law does not contain explicit rules on the consequences of procedural errors caused by German or other national authorities in the indirect or Member State enforcement of Union law. According to the general principles of Union administrative law, this gap is filled by national rules, which also include § 46 VwVfG NRW.
70
See Schneider, in: Schoch/Schneider/Schneider, VwVfG, 4. EL 2023, § 45 Rn. 31.
71
As long as the German authorities observe the principles of equivalence and effectiveness when applying the error consequences of the rules, procedural and formal errors can therefore in principle also be irrelevant in the indirect enforcement of Union law by the Member States. Within these limits, the Member State's error regime applies.
72
Cf. BVerwG, judgment of 29. October 2008 – 6 C 38/07 –, BeckRS 2009, 30118 Rn. 41; Schemmer, in: BeckOK, VwVfG, as of: 1. October 2024, § 46 Rn. 17.
73
The relevant data protection regulations do not contain a different assessment. It is true that the General Data Protection Regulation mentions in recital 129 sentence 5 a (unrestricted) right to hearing of the person concerned by a supervisory measure. However, this does not speak against the applicability of a Member State's error regime. On the one hand, the recitals are not independent legal norms with a regulatory character, but general objective formulations.
74
VG Ansbach, judgment of 12. June 2024 – AN 14 K 20.941 –, BeckRS 2024, 20312 Rn. 35.
75
On the other hand, the General Data Protection Regulation in Art. 58 para. 4 (also) refers to the regulations of the Member States with regard to the design of procedural rights, which in turn are to be interpreted and applied in the light of the requirements of Union law.
76
The requirements of § 46 VwVfG NRW are met. On the basis of the available documents and the arguments of the parties to the oral hearing, the Chamber is certain that the omitted hearing of the plaintiff has obviously not influenced the decision of the defendant on the merits, the contested decision of 00. March 0000 would not have turned out differently without this procedural defect.
77
The term "obvious" within the meaning of § 46 VwVfG NRW is to be understood objectively. Obviousness exists when the lack of causality is readily and without any reasonable doubt to an unbiased, familiar with the circumstances observer who is familiar with the circumstances, without any reasonable doubt,
78
cf. BVerwG, decision of 20. December 2013 – 7 B 18.12 –, BeckRS 2014, 45729 Rn. 24,
79
If, therefore, it is clear from the outset and after every view that the decision on the merits would not have been different even with proper proceedings, the authority would have decided the same without the procedural error. The only abstract possibility of a different decision is not sufficient afterwards.
80
Cf. BVerfG, decision of 24. October 2017 – 1 BvR 1026/13 – BeckRS 2017, 134894 Rn. 46; BVerwG, judgment of 21. January 2016 – 4 A 5.14 –, BeckRS 2016, 45459 Rn. 39.
81
However, if substantive law opens up discretion in the specific individual case or if the authority has room for discretion, it cannot generally be ruled out that the violation of the respective procedural provision has affected the decision on the merits. Therefore, errors are fundamentally relevant in these cases.
82
See Schneider, in: Schoch/Schneider/Schneider, VwVfG, 4. EL 2023, § 46 Rn. 51 m.w.N.
83
Exceptions to this principle are recognized if the error has demonstrably remained without influence on the decision for factual reasons.
84
See Schemmer, in: BeckOK, VwVfG, as of: 1. October 2024, § 46 Rn. 37 ff.
85
In particular, hearing errors should be unremarkable - even if the authority has room for manoeuvre - if it is established to the court's conviction that a timely hearing would not have influenced the decision on the merits.
86
See Schemmer, in: BeckOK, VwVfG, as of: 1. October 2024, § 46 Rn. 38.1.
87
According to this, it can be assumed that the defendant would have issued a warning in accordance with Art. 58 (2) (b) GDPR even if the plaintiff had been properly heard.
88
Admittedly, Art. 58 para. 2 b GDPR grants the competent supervisory authority discretion on the legal consequences side ("which allow it"). However, if it finds a violation of the provisions of the General Data Protection Regulation at the end of its investigation, it is obliged to react in an appropriate manner to remedy the inadecy of the inadecy found.
89
Cf. ECJ, judgment of 7. December 2023 - C-26/22 -, juris Rn. 57.
90
In the event of a data protection violation found, the discretion of the supervisory authority is thus condensed to the extent that only intervention against the person concerned is free of discretion.
91
Cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 144; VG Mainz, judgment of 24. September 2020 - 1 K 584/19. MZ -, BeckRS 2020, 28535 Rn. 50.
92
The defendant would have been obliged to intervene by the supervisory authority even if the plaintiff had been properly heard. Due to the extensive correspondence of the parties involved, a violation of data protection regulations by the defendant was already established before the defendant's decision was issued. Already in its statement of 15. In October 2020, the plaintiff admitted to having transmitted false balances to the SCHUFA in the period from October 2017 to January 2018. In addition, it filed in writing on the 5th. May 2021, to have refrained from reporting to the SCHUFA in the period from February to October 2018 despite the completion of the claim in the meantime. In this situation, the defendant had to react in an appropriate manner.
93
The defendant nevertheless had a discretion of choice with regard to the sanction measures pursuant to Art. 58 (2) GDPR, in the exercise of which it had to observe in particular the principle of proportionality,
94
cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 147; VG Ansbach, judgment of 12. June 2024 - AN 14 K 20.941 -, BeckRS 2024, 20312 Rn. 49 with reference to recital No. 148 of the GDPR,
95
This also does not lead to the fact that their decision would have turned out differently if the plaintiff had been heard. Even if there was a concrete possibility - for which nothing is apparent in view of the defendant's extensive investigation of the facts - that she would have reached a different decision with regard to the measure to be taken, the plaintiff could not invoke this. Due to the subjective unlawful relationship between the violated procedural law and a substantive legal position, as presupposed by § 113 (1) sentence 1 VwGO, the hypothetical substantive decision with regard to this legal position must be more favourable for the person concerned, provided that the unlawfulness relationship is not modified by a supra-individual (absolute) right of revocation.
96
See Schneider, in: Schoch/Schneider/Schneider, VwVfG, 4. EL 2023, § 46 Rn. 52.
97
However, since the defendant chose the mildest of the means available to her with the warning pursuant to Art. 58 (2) (b) GDPR, an infringement of the plaintiff is excluded in this respect.
98
The decision also satisfies the requirement of certainty according to § 37 para. 1 VwVfG NRW.
99
This presupposes that the content of the regulation adopted by the authority is so complete, clear and unambiguously recognizable for the parties involved, in particular for the addressee(s) of the administrative act, that they can judge their conduct accordingly.
100
See Ramsauer, in: Kopp/Ramsauer, VwVfG, 25. Rel. 2024, § 37 Rn. 5 m.w.N.
101
The recognizability of the content of the regulation is to be determined on the basis of an interpretation of the administrative act in accordance with §§ 133, 157 BGB on the basis of the wording, taking into account the further circumstances of the individual case and in good faith. It is not necessary that the content of an administrative act results precisely solely from the operative part; rather, the circumstances known to the parties or easily recognizable and, above all, the justification attached to the administrative act, must be used to interpret the content of the regulation.
102
See Ramsauer, in: Kopp/Ramsauer, VwVfG, 25. Rel. 2024, § 37 Rn. 5.
103
References in the administrative act to administrative acts previously issued to the parties, documents known to them and available to them or accessible at any time are also permitted.
104
See Ramsauer, in: Kopp/Ramsauer, VwVfG, 25. Rel. 2024, § 37 Rn. 5.
105
In accordance with this, the objected behavior can also be clearly inferred from the decision of the defendant without further specification of the alleged data protection violations. Based on the reference to the statements of the plaintiff in the administrative proceedings, it was sufficiently clear for the plaintiff to an overview of all circumstances that the alleged data protection violation should extend to two facts, namely the (inaccurate) reports of the balances to the SCHUFA in the period from October 2017 to January 2018 as well as to the omitted settlement of the remaining claim in the period from February to October 2018. The plaintiff had specified the underlying transactions in the administrative procedure herself, namely by letter dated 5. May 2021 (concerning the period February to October 2018) and letter of 23. June 2021 (concerning the period October 2017 to January 2018). Further requirements are not to be made, not least in view of the fact that only a violation of a data protection regulation is determined on the basis of the warning issued, without the addressee - in this case the plaintiff - being given an action, toleration or omission that may have to be determined in more detail.
106
VG Hannover, judgment of 27. November 2019 – 10 A 820/19 –, BeckRS 2019, 31874 Rn. 24.
107
The contested regulatory order is also sufficiently substantiated in terms of form. In accordance with § 39 para. 1 VwVfG NRW, the defendant communicated in her decision the essential factual and legal reasons that moved her to make her decision. This includes, in particular, their considerations on the proportionality of the measure expressed. Whether and to what extent the reasons given support the decision in legal terms is a question of the substantive legality of the contested administrative act.
108
The contested decision also proves to be lawful in material terms.
109
The requirements of Art. 58 para. 2 letter b GDPR are met. According to this provision, each supervisory authority has the authority to warn a controller if he has violated the General Data Protection Regulation with processing operations.
110
Insofar as the provision refers to the substantive provisions of the GDPR with regard to the question of the existence of a violation relevant to data protection law, this is not subject to any concerns in the present case.
111
It is true that neither the General Data Protection Regulation - including the supervisory authority powers standardized in Art. 58 (2) GDPR - nor the new data protection provisions at national level should apply to facts that were presented before the 25th May 2018 were completed. In this respect, a retroactive application of these provisions is prohibited with regard to the principle of the rule of law enshrined in Art. 20 (3) of the Basic Law.
112
Cf. BVerfG, decision of 10. October 2012 – 1 BvL 6/07 –, BeckRS 2012, 59344 Rn. 59.
113
Such a (real) retroactive effect of the new data protection laws would have required an express order of validity by the legislator. However, neither the GDPR nor the DSG NRW contain transitional regulations that also subject completed old cases to a subsequent assessment by the supervisory authority.
114
VG Düsseldorf, judgment of 11. October 2019 – 29 K 7031/19 –; BVerwG, judgment of 26. March 1985 – 9 C 47/84 –, juris Rn. 14.
115
However, this is not such a case, since the plaintiff's conduct of the defendant at the time of the entry into force of the General Data Protection Regulation on 25. May 2018 was not yet completed.
116
It is undisputed between the parties that the plaintiff also transmitted balances from the contractual relationship of her client Q. to the SCHUFA, even after the settlement of the claim, namely, among other things, on the 10th. June 2018 (358 Euro), 16. July 2018 (359 Euro), 12. August 2018 (359 Euro), 16. September 2018 (359 Euro) and on 14. October 2018 (360 Euro). These reports were made after the General Data Protection Regulation came into force on 25. May 2018.
117
Contrary to what the plaintiff believes, the plaintiff's obligation to report settled is not a uniform fact, since he was at the time of the actual settlement of the claim on the 20th. February 2018 and thus began before the entry into force of the General Data Protection Regulation, would have been completely withdrawn from the scope of the Regulation. According to Art. 4 No. 2 GDPR, processing within the meaning of the Regulation is every single process carried out (with or without the aid of automated procedures) or any such series of operations, so that in this respect every single data transmission to the SCHUFA is to be based. This corresponds to the fact that the respective notification on its part leads to a new registration with the SCHUFA, which entails further legal consequences (among other things with regard to the duration of the data storage). For the rest, the plaintiff's view led to a valuation contradiction that was incompatible with the provisions of the General Data Protection Regulation, since the (further) delayed completion notification by the lending institution would remain without sanction. Contrary to what the plaintiff believes, recital 171 sentence 2 GDPR cannot be found otherwise. In so far as processing that has already begun at the time of application of the GDPR should be reconciled with it within two years of its entry into force, nothing can be deduced from this case for the present case, since the recital does not indicate whether the data processing under reviewed or not has begun in the past.
118
In any case, the reports to the SCHUFA from 10. June 2018, 16. July 2018, 12. August 2018, 16. September 2018 and 14. October 2018 against the provisions of the General Data Protection Regulation, the factual requirements for the issued warning are met in this respect.
119
The notification of disturbed claims to the SCHUFA constitutes a processing operation within the meaning of Art. 4 No. 2 GDPR in the form of a transmission of data by electronic means. This processing concerns personal data according to Art. 4 No. 1 GDPR, namely those relating to an identified natural person, the loan debtor Q.
120
The plaintiff has the personal data as the controller within the meaning of Art. 58 para. 2 b DSGVO processed. According to Art. 4 No. 7 half-sentente 1 GDPR, the controller is, among other things, any legal person who alone or jointly with others decides on the purposes and means of the processing of personal data. This is the case here in relation to the plaintiff. As a creditor of the claim - an assignment to the debt collection agency was undisputedly not made - she transmitted monthly information about the balances of her debtor to the SCHUFA. In doing so, she acted - which is undisputed between the parties - with regard to the transfer of the data under her own responsibility and competence. This also results from the fact that the debt collection agency used for debt collection, which usually acts on the basis of a commission under the Legal Services Act, is not authorized or is not authorized to pass on the corresponding data independently without separate permission.
121
CF. VG Wiesbaden, judgment of 27. September 2021 - 6 K 549/21 -, BeckRS 2021, 35118 Rn. 42 f.
122
Whether the plaintiff is attributable to any misconduct of the debt collection agency in the context of debt collection, whether it was therefore acting as a controller within the meaning of Art. 4 No. 7 GDPR or in the context of order processing within the meaning of Art. 4 No. 8, 28 GDPR, can therefore remain open.
123
The plaintiff has violated Art. 5 para. 1 d GDPR when processing the personal data of its debtor.
124
According to this provision, anyone who does not process personal data in a way that ensures the factual and up-to-date accuracy of the personal data commits a data breach. All reasonable measures must be taken to ensure that personal data which are inaccurate with regard to the purposes of their processing are erased or rectified without delay.
125
Art. 5 (1) (d) GDPR concerns the data quality and obliges the controller to actively check the accuracy of the data.
126
See Roßnagel, in: Simitis/Hornung/Spiecker, Datenschutzrecht, DSGVO, 2. Rel. 2025, Rn. 136 ff.
127
He is obliged, regardless of a request directed by the data subject, to take all reasonable steps to ensure that incorrect data is immediately deleted or corrected.
128
See Heberlein, in: Ehmann/Selmayr, BeckOK General Data Protection Regulation, 3. Rel. 2024, Art. 5 Rn. 32.
129
To this end, the controller must take technical and organizational measures to ensure in an appropriate manner that factors that lead to incorrect personal data are corrected and the risk of errors is minimized.
130
See Roßnagel, in: Simitis/Hornung/Spiecker, Datenschutzrecht, DSGVO, 2. Edition 2025, Rn. 143.
131
If the incorrect date leads to an inaccurate legal consequence or may otherwise be detrimental to the data subject, the updating of the data is necessary.
132
See Roßnagel, in: Simitis/Hornung/Spiecker, Datenschutzrecht, DSGVO, 2. Circulation 2025, Rn. 141 m.w.N.
133
This also follows from recital 39 of the DGSVGO. According to this, all reasonable steps should be taken to ensure that incorrect personal data are deleted or corrected.
134
The defendant has not complied with this here. The court's conviction is certain that the plaintiff on the 10th June 2018, 16. July 2018, 12. August 2018, 16. September 2018 and 14. October 2018 objectively false balances to the SCHUFA and did not take all appropriate measures with regard to these data protection violations to immediately correct or delete the incorrect personal data.
135
The reports in question to the SCHUFA were objectively incorrect. Due to the debtor's receipts of payments or the remission of the remaining claim by the plaintiff, the loan claim and all interest claims were no later than 20. February 2018. Nevertheless, the applicant continuously transmitted until the 14th October 2018 Balances at the expense of the debtor to the SCHUFA. These reports were objectively likely to cause unfavourable legal consequences for the debtor. This already results with a view to a possible duration of data storage. According to the rules of conduct for the verification and deletion periods of personal data by the German credit agencies of 25. May 2018 in the version of 1. January 2020 ("CoC audit and deletion periods of the credit agencies"), data on due and undisputed claims will remain stored in the databases of the credit agencies as long as their settlement has not been announced. A separate audit by the credit agencies is only carried out after three years from the occurrence of the event. During this time, since the so-called score value is calculated on the basis of the existing entries, there may be disadvantageous legal consequences for the debtor concerned, because banks, insurance companies, telephone companies and other commercial enterprises often rely on corresponding information with regard to the assessment of future contractual partners.
136
See for example LG Berlin judgment of 27. April 2011 – 4 O 97/11 –, BeckRS 2011, 20005.
137
The retroactive deletion of the SCHUFA entries does not change this.
138
Contrary to Art. 5 para. 1 d GDPR, the plaintiff has not taken all appropriate measures to immediately correct or delete the defective personal data of the debtor. It would have had a special reason to do so, on the basis of the circumstances of the individual case, since even before the failure to report of completion in question, errors had occurred in the processing of Mr Q.'s personal data and the plaintiff was aware of these irregularities. The plaintiff knew at the latest on the 20th. February 2018, that all reports to the SCHUFA on the balances of the debtor in the period from 15. October 2017 to January 2018 were incorrect. With a letter of the same date, she reported the settlement of the claim to the responsible debt collection agency after she had previously waived the remaining claim of 357.69 euros - due to a decision of its board of directors. In the case of such a situation, the applicant should have ensured that the data was immediately corrected, regardless of whether it had a functional internal control system in principle. This is especially true because they have sent the incorrect reports to the SCHUFA in the period from 15. October 2017 to January 2018 due to the non-posting of the cash deposits in the core banking system. Even if, as the plaintiff's legal representative stated in the oral proceedings, prior involvement of the debt collection agency was required for technical reasons before a corresponding completed notification to the SCHUFA, an additional control of the data by the plaintiff should have been carried out by the plaintiff at the latest after receipt of the weekly completion list. Nevertheless, the applicant did not carry out a separate check of the completed reports at any time, although the control system existing at that time carried out a verification of the data only on a random basis and on a monthly basis. It has not been possible for the plaintiff to manually check the data with the technical and organizational means at her disposal, she has neither claimed nor is this recognizable due to other circumstances.
139
Submit the false reports to the SCHUFA from 10. June 2018, 16. July 2018, 12. August 2018, 16. September 2018 and 14. October 2018 in each case violations of Art. 5 para. 1 d GDPR, it can remain open whether the defendant (also) with regard to the incorrect reports in the period of 15. October 2017 to 14. January 2018 - possibly on the basis of § 38 para. 5 BDSG a.F. - could have issued a warning.
140
The warning does not meet any far-reaching legal concerns on the legal side. The defendant has exercised the discretion granted to her under Art. 58 (2) GDPR without error (§ 114 sentence 1 VwGO). Contrary to the view of the plaintiff, in particular a violation of the principle of proportionality, which must be observed when selecting the measures available pursuant to Art. 58 (2) GDPR,
141
cf. OVG NRW, judgment of 15. June 2022 - 16 A 857/21 -, juris Rn. 147,
142
not to recognize. The purpose of the General Data Protection Regulation is to ensure uniform monitoring and enforcement of the Regulation throughout the Union (see recital 129 sentence 1 GDPR). Due to the warning function it has, it is also suitable for establishing data protection-compliant states. It is also necessary. With the warning, the defendant has chosen the mildest remediary instrument in the catalogue of measures of Art. 58 (2) GDPR. Finally, the order is also appropriate, i.e. proportionate in the narrower sense. The purpose pursued by the order is not out of proportion to the gravity of the intervention. In particular, it must be taken into account that the plaintiff has repeatedly violated Art. 5 para. 1 d GDPR as part of its data processing and that this violation concerned particularly sensitive data of the contract customer concerned. On the other hand, the warning - unlike, for example, the imposition of a fine in Art. 58 (2) (i GDPR) - constitutes a minor interference with the rights of the plaintiff, since it does not involve any direct financial disadvantages. The fact that the defendant, in order to justify its decision, now primarily referred to the lack of completion of the completion in the period from 11. March 2018 until 14. October 2018, in view of the fact that the data protection violation complained of was already the subject of the contested decision (page 2), it is also not objectionable in accordance with § 114 sentence 2 VwGO.
143
The decision on costs is based on § 154 para. 1 VwGO.
144
The decision on the provisional enforceability follows from § 167 VwGO i.V.m. § 708 No. 11, 711, 709 sentence 2 ZPO.
145
Legal Remedies
146
Within one month of service of this judgment, a written request may be made to the Administrative Court of Düsseldorf that the Higher Administrative Court for the Land of North Rhine-Westphalia in Münster may allow the appeal. The motion must identify the judgment appealed.
147
Within two months of service of the judgment, the grounds for which the appeal is to be granted shall be set out. The justification must be submitted in writing to the Higher Administrative Court for the State of North Rhine-Westphalia in Münster, unless it has already been submitted with the application.
148
The application must be submitted and substantiated by a lawyer or a law teacher at a state or state-recognised university of a Member State of the European Union, another Contracting State of the Agreement on the European Economic Area or Switzerland, who is qualified to serve as a judge, or a person equivalent to them as authorized representative. Public authorities and legal persons under public law, including associations formed by them for the performance of public tasks, may also be represented by their own employees qualified to serve as a judge or by employees with capacity to serve as a judge by other authorities or legal persons under public law, including associations formed by them to perform their public tasks. Reference is made to the special regulations in § 67 para. 4 sentences 7 and 8 VwGO.
149
Resolution
150
The value of the subject matter of the dispute is
151
5.000,- Euro
152
fixed.
153
Reasons
154
The determination of the amount in dispute is based on § 52 para. 2 GKG.
155
Legal Remedies
156
This decision may be appealed against within six months after the decision on the merits has become final or the proceedings have been otherwise settled, in writing or for the record of the Registrar of the Registry, on which the Higher Administrative Court for the Land of North Rhine-Westphalia in Münster decides, if the Administrative Court does not remedy it. If the amount in dispute has been determined less than one month before the expiry of the said period, the complaint may be lodged within one month of service or informal notification of the determination decision. The complaint is only admissible if the value of the object of the complaint exceeds two hundred euros. The appeal shall also take place if the court which issued the decision allows it because of the fundamental importance of the question before the decision.
