VG Frankfurt am Main - 5 L 1623/22.F
From GDPRhub
| VG Frankfurt am Main - 5 L 1623/22.F | |
|---|---|
 | |
| Court: | VG Frankfurt am Main (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(e) GDPR Article 18(1)(d) GDPR Article 21 GDPR |
| Decided: | 15.07.2022 |
| Published: | |
| Parties: | The Federal Office of Economics and Export Control |
| National Case Number/Name: | 5 L 1623/22.F |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | openJur (in German) |
| Initial Contributor: | n/a |
The Administrative Court Frankfurt am Main rejected a data subject's claim for injunctive relief against the processing of personal data by the Federal Office of Economics and Export Control as the encryption standards adopted by the latter were deemed sufficient.
English Summary
Facts
The data subject is engaged in the dealing of firearms which are subject to a prohibition with a reservation of permission. Moreover, as became known in a separate court decision, the data subject is afraid of becoming a victim of kidnapping or robbery.
The Federal Office of Economics and Export Control, the data controller, is the supervisory authority of the data subject in regards to the German laws on war weapons and has largely switched to electronic legal transactions via its communication portal: the electronic war weapons register.
The data subject contacted the controller and complained that future information on the electronic war weapons register should only be transmitted by e-mail which is encrypted by a special software and objected to the current form of transmission as a precautionary measure under Article 21 GDPR and requested a restriction of processing under Article 18 GDPR. Additionally, the data subject complained about the controller's email communication, pointed out that the messages contained personal data within the meaning of Article 4(1) GDPR, and requested appropriate technical and organisational measures in accordance with the state of the art, such as end-to-end encryption, as well as the restriction of the processing pursuant to Article 18(1)(d) GDPR.
The controller promised to carry out an examination but continued to use email to communicate with the data subject. The data subject took this as an occasion to apply for an exemption from the legally obligatory electronic notification of his weapon dealings. Eventually, his application was rejected and he was asked to continue using the controller's online portal for future notifications.
As a response, the data subject brought an action for injunction before the Administrative Court of Frankfurt am Main concerning the controller's data transfers.
The controller asked the court to reject the data subject's notion, reasoning that the data processing was justified by Article 6(1)(e) GDPR. Moreover, the GDPR would not contain a basis for the claim for the injunction sought by the applicant. At most, a general claim for injunctive relief under public law could be considered. However, the transfer of data had been necessary for the performance of the tasks of the public bodies to which the data had been transferred.
Holding
The court rejected the data subject's action for injunction.
It ruled that there is no infringement of rights due to an unlawful impairment of the legal positions of the applicant for a claim for injunctive relief under public law. There is a necessary legal basis for the processing of personal data and the processing, as to its legality and constitutionality, is not subject to any serious doubts by the court. The German EGovernment-Law, which purposefully expands electronic communication and also is the basis for the electronic war weapons register, is a democratically legitimised decision that does not conflict with the GDPR.
With regard to the data subject's demand for higher encryption, the court has already stated in one of its decisions (15 July 2022 - 5 L 1281/22.F) that, in the case of electronic communication in connection with the notification of war weapon stocks to the Federal Office of Economics and Export Control, end-to-end encryption is currently sufficient. A higher level encryption is not necessary.
Moreover, insofar as the data subject is particularly concerned with e-mail correspondence, the security standard of transport encryption demonstrated in the proceedings also satisfies the standards for the area of the electronic war weapons register.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
1. The security standard at the Federal Office of Economics and Export Control currently meets the requirements for the transmission of personal data in the area of the electronic war weapons register. 2. Whether a cease-and-desist obligation pursuant to Section 167 (1) sentence 1 i. V. m. § 890 ZPO by threatening a fine of up to 250,000 euros (and, in the event that this cannot be collected, imprisonment for up to six months) or via § 172 VwGO with a fine of up to 10,000 euros would have to be enforced remains open. tenor The request will be denied. The applicant has to bear the costs of the procedure. The amount in dispute is set at EUR 2,500. reasons I The applicant opposes the processing of his personal data by means of electronic communication on the Internet. The applicant sells primarily to security authorities. ......, which are subject to a ban with the reservation of permission after .......... and whose products, due to their physical and chemical properties, are particularly suitable for abusive activities, such as ........ .... own. He is the person affected by the decision of the Federal Administrative Court of June 10, 2021 - 3 B 19/20 - (juris = BeckRS 2021, 19844) and fears becoming the victim of a kidnapping or robbery in order to get to the stored products. The Federal Office of Economics and Export Control (hereinafter "Federal Office") is the respondent's monitoring authority within the meaning of Section 14 (8) KrWaffG in conjunction with Section 2 KrWaffKontrGDV 1 and has largely switched processes in its area of responsibility to electronic legal transactions via its communication portal ELAN-K2 . The electronic war weapons book is kept with him. According to Section 10 (3) sentence 1 KrWaffKontrGDV 2, notifications of changes in population must be submitted electronically from April 1, 2020. The first data transmission of a report had to be made electronically via the ELAN-K2 communication portal by the deadline of September 30, 2020. On August 24, 2020, the applicant contacted the Federal Office and complained that future information on the electronic war weapons log - in addition to being published on the Federal Office's website - would be sent by e-mail and suggested that it be encrypted using the "Chiasmus" software , objected to the current form of transmission as a precautionary measure in accordance with Art. 21 GDPR and requested a suspension in accordance with Art. 18 GDPR. On August 24, 2020, 3:24 p.m., the Federal Office sent the applicant an e-mail message containing, among other things, the name of the applicant and the full address of a ....... On August 25, 2020, the applicant complained about the e-mail dispatch, pointing out that this e-mail message contained personal data within the meaning of Art. 4 No. 1 DSGVO and required state-of-the-art technology appropriate technical and organizational measures, namely end-to-end encryption, as well as the suspension of processing in accordance with Article 18(1)(d) GDPR. In a letter dated August 31, 2020, the Federal Office agreed to an examination and suspended the processing of the applicant's information by e-mail until it was completed, as requested by the applicant, in accordance with Article 18(1)(d) GDPR. However, on September 29, 2020, 7:32 a.m. and 7:33 a.m., the applicant was again sent e-mail messages with location information via the Internet, which he reprimanded in a letter dated October 2, 2020 and took as a precautionary measure the exemption from the obligation to Submission of the electronic report according to § 10 Para. 5 KrWaffKontrGDV 2 to apply. On December 15, 2020, the Federal Office asked for an explanation of the need for protection, which the applicant submitted on January 27, 2021. In a letter dated April 1, 2021, the applicant submitted the reporting date of March 31, 2021 to the Federal Office on an attached CD and applied for the illegality of the data transfer dated September 29, 2020 to be determined. In a letter dated October 1, 2021, the applicant submitted the reporting date as of September 30, 2021 also on CD and requested a decision regarding his opposition of August 25, 2020 and application of October 2, 2020. On January 5, 2022, the applicant applied to the Federal Office for information in accordance with Art. 15 (1) GDPR with a copy in accordance with Section 15 (3) GDPR. The application for exemption from the obligation to submit the electronic report was rejected by the Federal Office in a decision dated March 23, 2022, pointing out that the applicant would have to use the ELAN-K2 portal for future reports; the applicant filed an objection to this on April 2, 2022, the decision of which is not yet apparent to the court. On April 1, 2022, the applicant contacted the Federal Office about his application of January 6, 2022 and pointed out the deadlines under Article 12 (3) GDPR. On April 2, 2022, the applicant announced that he would bring an action for failure to act if his objection of August 25, 2020 was not decided by April 15, 2022, 12 noon. On April 20, 2022, the applicant brought an action before the Administrative Court of Frankfurt am Main because of the data transfer of August 24, 2020 and September 29, 2020 and the pending decision on his objection of August 24, 2020, which was filed under the business number 5 K 1094/ 22.F is led. Due to the requested provision of information and its delay, the applicant brought an action before the administrative court in Frankfurt am Main on April 13, 2022, which is filed under the reference number 5 K 1030/22.F. An application dated May 9, 2022 to the Administrative Court of Frankfurt am Main for the issuance of an interim order, with which the applicant can assert his rights under Art. 5, 18, 21 and 32 GDPR through technical and organizational measures that correspond to the state of the art and the high risk, which from his point of view is only the case with end-to-end encryption corresponding to the state of the art was rejected by the Frankfurt am Main Administrative Court by decision of July 15, 2022 - 5 L 1281/22.F. A complaint against this is pending at the Hessian Administrative Court under business number 6 B 1341/22. On June 22, 2022, the applicant brought an action before the administrative court in Frankfurt am Main to supplement the information provided by the Federal Office on May 2, 2022 and to refrain from transmitting personal data to third parties, unless this is permissible in exceptional cases due to a special statutory regulation , which is listed under the business number 5 K 1624/22.F. The necessary legal basis for data transmissions was missing. At the same time, he applied for a temporary injunction. The applicant requests: 1. The Respondent is temporarily obliged as part of an interim order until a decision is made on the main issue, to refrain from transmitting the applicant’s personal data to third parties, unless this is expressly permitted in exceptional cases on the basis of a special statutory regulation. 2. The Respondent is threatened with a fine of up to €250,000 for each violation of the obligation to cease and desist pursuant to Item 1. The Respondent requests to reject the application. The Respondent sees the applicant's request based on two data transmission processes, namely a request from the then Federal Ministry of Economics and Technology dated May 11, 2011 with the request for a test report from the Federal Office regarding the intended purchase of two fully automatic rifles and a request from the Federal Criminal Police Office dated May 2 July 2015 for granting an exemption for a prohibited weapon within the meaning of Section 40 of the Weapons Act. The request of the urgent application that the respondent refrain from transmitting personal data of the applicant to third parties, unless a special legal regulation allows this, only describes the prohibition with permission reservation of the legal regulation of Art. 6 Para. 1 DSGVO, according to which any processing of personal data is inadmissible unless there is a justifiable reason. The application request is therefore too vague and not enforceable. In addition, the processing of personal data is not only permissible if a special statutory regulation expressly permits this, rather Art. 6 (1) sentence 1 lit. a to f GDPR already lists numerous other legal bases justifying data processing and also Art. 28 GDPR allow disclosure to third parties. Irrespective of this, the General Data Protection Regulation does not contain any basis for a claim for the omission sought by the applicant. At most, a general public-law injunctive relief would be considered. Data processing up to May 24, 2018 should be measured against the old Federal Data Protection Act. According to this, there are no data processing operations relevant to data protection law that require justification under data protection law; on the other hand, the respondent was entitled to transmit data to the then Federal Ministry of Economics and Technology as well as to the Federal Criminal Police Office. The data transmission was necessary for the fulfillment of the tasks of the public authorities to which the data was transmitted. II. The application is unsuccessful (A.), so that the applicant has to bear the costs of the procedure (B.). The value in dispute is to be set at half the value in dispute (C.). A According to Section 123 (1) VwGO, which is the only relevant option here, the court can, upon application, issue an interim order to regulate a provisional situation in relation to a contentious legal relationship, even before an action is filed, if, especially in the case of permanent legal relationships, this regulation appears necessary in order to avert significant disadvantages or to prevent the threat of violence or for other reasons. The actual requirements of the asserted claim and the reason for the necessary provisional regulation must be made credible (§ 920 Para. 2 ZPO in conjunction with § 123 Para. 3 VwGO, § 294 ZPO). The application for the issuance of a regulatory order is permissible and sufficiently specific in terms of content (1.), but remains unsuccessful due to the lack of a right to an order (3.), although a reason for the order can be assumed (2.). 1. The application is - according to the similarly stored, previously submitted application for business number 5 L 1281/22.F - admissible according to § 123 Para Clause 1, Section 111 Clause 1, Section 113 Para. 3 Clause 2, Para. 4, Section 169 Para. 2, Section 191 Para 2 BGB) - and in any case not with an action for rescission within the meaning of § 42 Para. 1 Alt. 1 VwGO - is to be pursued. The request for the issuance of an interim injunction is congruent with the request for the lawsuit filed at the same time, filed under reference number 5 K 1624/22.F, insofar as the request to convict the defendant is also being pursued there by way of the objective accumulation of lawsuits , "to refrain from transmitting the plaintiff's personal data to third parties, unless this is permitted in exceptional cases on the basis of a special statutory regulation." The request for the issuance of an interim order clearly does not relate to the request for completion of the information provided on May 2, 2022, which is also pending in the lawsuit 5 K 1624/22.F. 2. The applicant has made a reason for the order credible. The court understands the request of the applicant - also against the background of the procedure 5 L 1281/22.F, with which an end-to-end encryption in the electronic communication with the opponent was requested - to the effect that the applicant The transmission of personal data to third parties also involves electronic communication with the respondent in general, which he does not consider to be sufficiently secure so that third parties could access the information transmitted, because the recognizable reason for his request are e-mail messages from the Federal Office dated August 24, 2020, 3:24 p.m., and September 29, 2020, 7:32 a.m. and 7:33 a.m., at ......... However, such communication can still be expected, also with regard to the obligation to electronically report stocks of war weapons the reporting dates from § 10 para. 1 sentence 1 KrWaffKontrGDV 2. 3. However, the applicant has no substantive injunctive relief (a.), so that the question of compulsory enforcement does not arise (b.). a. For the public-law defense and injunctive relief - which is the only consideration here - recognized under customary law (cf. HessVGH, decision of February 8, 2019 - 8 B 2575/18 -, juris marginal number 19 = BeckRS 2019, 4401 marginal number 15; Maurer/Waldhoff, AllgemVwR, 19th edition 2017, § 30 para. 6, 14 f.; Kranz, NVwZ 2018, 864) there is already no infringement of rights through an illegal impairment of (fundamental or European) law-protected positions of the applicant . The necessary legal bases for the processing of personal data are available in a specific area and are not subject to any sweeping doubts by the court as to their legality and constitutionality. The Second Ordinance for the Implementation of the War Weapons Control Act - FNA 190-1-2 - is based on Section 11(4), Section 12(7) and Section 14(7) of the War Weapons Control Act. The introduction of the electronic war weapons log by the third ordinance amending the second ordinance for the implementation of the law on the control of war weapons of March 13, 2020 (Federal Law Gazette I p. 521), which resulted in the introduction of electronic legal transactions from April 1, 2020 and which is probably the main reason for the dispute(s) between the applicant and the Federal Office, aims at the electronic transmission of war weapons stocks via an electronic interface or a reporting portal, corresponds to the desire of the companies to digitize the surveillance process, should reduce the effort the collection and entry of registration data, enable the monitoring authority to carry out targeted and rapid evaluations of war weapons stocks while at the same time reducing the error rate compared to manual evaluation and also help to map the life cycle of a weapon as long as it is within the area of responsibility of the War Weapons Agency control law (cf. BR-Drs. 637/19). In doing so, it is pursuing a legitimate purpose with a proportionate design of the obligation ordered. As already stated in the resolution of July 15, 2022 - 5 L 1281/22.F -, p. 8, with reference to the eGovernment Act, the expansion of electronic communication is being pursued in a targeted manner. This objective is a democratically legitimized decision that does not conflict with the General Data Protection Regulation. If the applicant criticizes the implementation of the standard and concludes from this that he is entitled to an injunctive relief because of his right to informational self-determination as part of his general right of personality, the court cannot follow him. The court has already stated this with regard to end-to-end encryption in its decision of July 15, 2022 - 5 L 1281/22.F - and also applies to the processing of personal data in legal transactions of the parties involved in general. Insofar as the applicant is particularly concerned with e-mail correspondence, the security standard of transport encryption shown in procedure 5 L 1281/22.F satisfies the standards for the area of electronic war weapons registers. b. Whether an obligation to cease and desist pursuant to Section 167 (1) sentence 1 in conjunction with Section 890 ZPO by threatening a fine of up to 250,000 euros (and, in the event that this cannot be collected, imprisonment for up to six months) or via Section 172 VwGO would have to be enforced with a fine of up to 10,000 euros (on this SchochKoVwGO/Pietzner/Möller, 41 EL July 2021, VwGO § 172 marginal number 16, see also SchochKoVwGO/Meissner/Steinbeiß-Winkelmann, § 173 marginal number 313 ), can therefore be left undecided. B. The applicant has to bear the costs of the procedure according to § 154 Abs. 1 VwGO, since he is unsuccessful. C The determination of the amount in dispute follows from Section 53 Paragraph 2 No. 1, Section 52 Paragraph 1, 2 GKG. The court assumes that the value in dispute is EUR 5,000, which is to be reduced according to No. 1.5 sentence 1 of the 2013 Catalog of Values in Dispute.
