VG Magdeburg - 1 A 217/22 MD
From GDPRhub
| VG Magdeburg - 1 A 217/22 MD | |
|---|---|
 | |
| Court: | VG Magdeburg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 58(1)(a) GDPR Article 58(2)(f) GDPR Article 58(2)(g) GDPR |
| Decided: | 18.03.2024 |
| Published: | 16.10.2024 |
| Parties: | |
| National Case Number/Name: | 1 A 217/22 MD |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | openJur (in German) |
| Initial Contributor: | la |
A court held that if a controller does not comply with the legal obligations regarding cold calling this fact has to be taken into account for the balancing test under Article 6(1)(f) GDPR. The court confirmed that this balancing test turned out against the controller, thus the processing was unlawful.
English Summary
Facts
The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted.
Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller.
After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call.
Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order.
In addition, the DPA ordered the controller under Article 58(1)(a) GDPR to demonstrate to the DPA the compliance with the orders by showing which measures were taken.
In case of non-compliance the DPA threatened an administrative fine.
The controller appealed this order before the Administrative Court Magdeburg (Verwaltungsgericht Magdeburg – VG Magdeburg).
Holding
The court dismissed the controller’s appeal. The only possible legal ground for the processing of personal data in this case is Article 6(1)(f) GDPR. But in this case the processing cannot be based on Article 6(1)(f) GDPR. The court held that cold calling might fall out of the scope of application of Article 6(1)(f) GDPR because Article 13(3) of the Directive 2002/58/EC (ePrivacy Directive) in conjunction with § 7(2)(1) German law against unfair competition (Gesetz gegen den unlauteren Wettbewerb - UWG) could be lex specialis. § 7(2)(1) UWG states that advertising by means of a telephone call made to a consumer without his or her prior express consent, or made to another market participant without at least the latter’s presumed consent constitutes an unacceptable nuisance to a market participant and is illegal.
However, the court’s decision does not depend on this question since the processing of personal data in this case also fails the balancing test under Article 6(1)(f) GDPR. This is due to the fact that the processing of phone numbers for cold calling purposes fails to match the criteria of § 7(2)(1) UWG which can be taken into consideration.
The court dismissed the controller’s argument that German competition law and the GDPR had different purposes and therefore, the DPA should not enforce competition law through the application of Data protection law. The court argued that an overall view would lead to the conclusion that it the cold calling was a uniform process in a way that the processing of personal data has the purpose of illegal cold calling. Therefore, the controller cannot argue that the DPA was not competent to enforce competition law.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
If the processing of personal data in the context of a telephone advertising approach via "cold calls" does not comply with the other legal requirements (here: Section 7 Paragraph 2 No. 1 UWG), this circumstance must be taken into account in the balancing of interests within the framework of Art. 6 Paragraph 1 Letter f of GDPR to the detriment of the person responsible.
Rubrum
Tenor
The action is dismissed.
The plaintiff shall bear the costs of the proceedings.
The judgment is provisionally enforceable with regard to the costs. The plaintiff may avert enforcement by providing security in the amount of 110% of the amount to be enforced on the basis of the judgment, unless the defendant provides security in the amount of 110% of the amount to be enforced before enforcement.
Facts
The plaintiff objects to an instruction pursuant to Art. 58 Paragraph 1 of the GDPR.
With the homepage www..., it operates a portal on which advertisements for holiday accommodation are published for the purpose of room placement. The portal is advertised with the slogan "the easiest way to find a room!" On the homepage there is a changing ad text which states, among other things: "... is not only aimed at holiday guests and tourists. Many offers are specially designed for families on a tight budget, tradesmen, business people, fitters and students" and "You search and we will find the right properties for you such as: apartments, farms, holiday homes, guest houses, hotels, fitters' rooms, exhibition rooms, guest houses". Accordingly, landlords of such accommodation can present themselves on the portal. On April 7, 2022, there were a total of 28,688 advertisements on the portal www...
In order to attract landlords to present their accommodation on the portal, the plaintiff actively conducts telephone advertising. For this purpose, among others, the plaintiff commissioned the call center of the company "Q. based in Kosovo. Call center employees search for landlords' telephone numbers on the Internet, e.g. on the websites of hotels and accommodation facilities or on tourism/accommodation lists published on the Internet. The call center employees enter these telephone numbers into the dialing mask of a dialer software and thus contact the accommodation operators by telephone in order to introduce them to the agency portal www... and to offer a contract for an advertisement in the form of a free test entry ("basic entry") for one or two months or in the form of a paid "premium entry" and, if possible, to conclude the contract by telephone. During the telephone call, the call center employee asks for data on the customer and the accommodation. Information material and confirmation letters for concluded contracts are sent to the conversation partners by email following such telephone calls. Information about the data processing and the rights of the data subject in accordance with Art. 14 GDPR is usually received by the data subjects together with the contract confirmation after the telephone call. The telephone numbers of persons who have stated in telephone calls that they do not want to be called (anymore) are stored in a blacklist by the call center employees.
In connection with 20 data protection complaints received by the defendant, it became known that the posting of a free test entry on the plaintiff's portal, which had been obtained through a previous call, resulted in further acquisition calls with the aim of concluding a contract via a paid advertisement and that the plaintiff generally had no contact with the persons called before the first call. In addition, the defendant found that persons affected exchange experiences with the plaintiff in various Internet forums.
In a letter dated May 9, 2022, the defendant heard the plaintiff's views on the intended issuance of an instruction in accordance with Art. 58 (1) GDPR. The plaintiff commented on this in a letter dated June 23, 2022 and presented the defendant with, among other things, a white book on the "workflow of the call center and employees regarding contacting potential customers via dialer software, customer acceptance/processing in accordance with GDPR guidelines" [sic] and other documents. In a letter dated August 22, 2022, the defendant dealt in detail with the plaintiff's arguments in her statement of June 23, 2022 and gave her the opportunity to comment again on the facts relevant to the decision explained in the hearing letter. On September 12, 2022, the plaintiff sent a letter dated the same day by email in advance, in which she commented on various points of the defendant's letter of August 22, 2022 in the form of partially quoting a statement from the external data protection officer she employed. The plaintiff submitted the full statement of the data protection officer on September 22, 2022.
By decision of October 27, 2022, the defendant instructed the plaintiff pursuant to Art. 58 (2) (f) GDPR to refrain from collecting and further processing telephone numbers for the purpose of advertising until one week after this decision becomes final and binding if a specifically identifiable natural person can be reached at each of these telephone numbers, unless a) the plaintiff can prove that he has the prior consent of this person with regard to the advertising calls in accordance with Art. 6 (1) sentence 1 (a) GDPR in conjunction with Art. 7 GDPR or b) it can be concluded, on the basis of specific factual circumstances, that this person has a factual interest in an advertisement on the plaintiff's website and that it can be assumed that the person is expecting this call or at least has a positive attitude towards it, e.g. from an existing business relationship between this person and the plaintiff (item 1). In addition, the defendant instructed the plaintiff pursuant to Article 58 paragraph 1 letter a of the GDPR to provide him with evidence, within two weeks of the decision becoming final, of when and which measures it had taken to implement No. 1 of this instruction (item 2). He further instructed the plaintiff in accordance with Article 58 (2)(g) GDPR to delete from the plaintiff's database all telephone numbers that were collected for the purposes of advertising contact within one week after the decision became final and binding if a specifically identifiable natural person can be reached at each of these telephone numbers, unless a) the plaintiff can prove that the person has given prior consent to the advertising calls in accordance with Article 6 (1)(a) GDPR in conjunction with Article 7 GDPR or b) it can be concluded, on the basis of specific factual circumstances, that this person has a factual interest in an advertisement on the plaintiff's website and that the person is expecting this call or at least has a positive attitude towards it, e.g. from an existing business relationship between this person and the plaintiff (item 3). The defendant also instructed the plaintiff, pursuant to Article 58 (1)(a) GDPR, to provide him with evidence of when and which measures it had taken to implement No. 3 of this instruction within 2 weeks of the decision becoming final (No. 4). In the event that the plaintiff did not fully comply with its obligations within the set deadline, the defendant threatened to impose a penalty of €5,000 for each measure not taken or not fully taken in accordance with Nos. 1 and 3 and a penalty of €1,000 for each evidence not or not fully submitted in accordance with Nos. 2 and 4, thus up to €12,000 (No. 5). For the details of the reasoning, reference is made to the decision.
The plaintiff filed suit on November 29, 2022. She is of the opinion that by issuing the contested decision, the defendant is effectively banning her from practicing her profession or fundamentally interfering with her business. The collection and processing of telephone numbers does not originally fall within the scope of data protection, as it is to be monitored by the defendant under the GDPR. The defendant can carry out data protection audits on the handling of personal data within his area of responsibility. In particular, if a data subject's request for deletion is not met, this would regularly bring the defendant into action. This raises the question of whether such a request for deletion was even made to her - the plaintiff - by the data subject. In her respective calls to the data subjects in the 3 specific cases that gave the defendant reason to take action against her, she made the data subjects aware of the general legal components of the contract and of the observance and compliance with the provisions of the Data Protection Act and informed them of this. In these three specific cases, however, the affected parties did not approach the defendant to assert violations of data protection regulations, but to express complaints, primarily of a civil nature. The respective clerk took this as an opportunity to inform the dissatisfied customers about data protection regulations and to ask questions about them, which led to the affected parties then also declaring objections under data protection law. The defendant therefore gave the affected parties instructions and essentially sent the data protection complaint to the affected parties in a pre-formulated form. She cannot be blamed at all, particularly with regard to the deletion of personal data. The defendant concludes from the three specific cases at hand and referred to that there are a very large number of affected parties making complaints and refers in particular to dubious entries on relevant websites on the Internet.The fact that he had to resort to such information was indicative of the fact that he had no specific cases that justified him in taking the above-described approach and was therefore taking up general complaints of a contractual nature in order to create a data protection approach for himself. The defendant therefore shifted his task to the point in time at which contact was made with the data subjects to initiate the contract in order to make it impossible to make contact and thus conclude a contract. In this context, the defendant clearly advocated the civil law and purely customer-oriented interests of some of its customers. This had nothing to do with data protection. In order to avoid being exposed to this accusation, the defendant had started to construct his data protection monitoring order by drawing on competition law issues. It was not the controller within the meaning of Art. 4 No. 7 GDPR. No personal data was processed either, but only telephone numbers of accommodation providers, which were not directly related to a natural person and were suitable for identifying them. When a call is made to an accommodation facility, different people will inevitably answer. It is therefore not a matter of assigning telephone numbers to a person, but simply of the telephone numbers intentionally published by the accommodation facility for contact purposes. The contact is not clearly intended to be called about an accommodation request. In the absence of other telephone connections, these telephone numbers are also used for questions about technical and other purposes in connection with the accommodation facility. This is also the case when they call their customers. At the beginning of a telephone conversation with the call center, potential customers are informed about data protection regulations and in particular about their rights in connection with data collected, its processing and handling, as well as about the fact that the customer can request that their data be deleted at any time in order to protect their data if a contract is not concluded. When selecting telephone numbers, no personal data is processed. The call center employee in question looks for a telephone number of an accommodation facility from publicly accessible sources and calls it directly. The telephone numbers are neither downloaded nor saved, but are only briefly displayed on the agent's screen for the immediate purpose of a telephone call. The defendant also uses competition law to specify the requirement of consent or presumed consent of a person affected. However, the protective purpose of this regulation lies in the mutual relationship between advertising service providers, i.e. the relationship between the plaintiff and its competitors in the area of providing advertising platforms and the like for accommodation establishments is affected by competition law. The defendant is attempting to undermine the protective purpose of Art. 6 GDPR by discussing the competition law issues regarding the admissibility of advertising calls. Regardless of the fact that it is permitted to operate commercially with so-called "cold calls" anyway, the legality under data protection law is ensured by the fact that the people called receive a data protection notice at the beginning. In addition, in the majority of cases, the people affected have given their consent to the data processing. With the exception of the three cases mentioned by the defendant, no other cases are known and are not specifically named. The reference to messages from dissatisfied customers in Internet forums is by no means sufficient to assume that a large number of people have brought data protection-relevant allegations to the defendant. Nor is it the task of data protection to protect those affected from harassment that may be anti-competitive. In addition to the actual consent, the question of presumed consent is almost irrelevant. However, those affected have a vital interest in getting to know their offer, which means that the presumed consent of those affected is given. They offer a free trial period that no other advertising provider offers and very low costs for publishing and advertising the objects. Art. 6 Para. 1 lit. b GDPR deals with the need for data processing for the performance of the contract. At the time the call center first calls the people affected, a contract has not yet been concluded. However, for the later fulfillment of the contract, the recording of data is absolutely necessary, so that the data processing is also lawful within the meaning of Art. 6 Paragraph 1 Letter b GDPR. If a contract is not concluded, at least the legal institution of culpa in contrahendo should be used, whereby the application of the provision also extends to the pre-contractual arrangements. Furthermore, according to Art. 6 Paragraph 1e GDPR, the processing of data is also lawful if it is necessary in the public interest. Such a public interest certainly consists at least in the fact that taxes are also generated within the framework of concluded contracts. The restrictions listed in Art. 6 Paragraph 1 Letter f GDPR relate to the legitimate interests of the data subjects or their fundamental rights and freedoms. An interference with a fundamental right or the fundamental freedoms of the data subjects is not apparent. The defendant assumes that the legitimate interest of the data subjects can already be seen in the fact that they are harassed by telephone calls. However, it can be assumed that the majority of the people called would be interested in the very interesting offer, which is reflected in the large number of contracts concluded and implemented. The defendant's measure is not proportionate. In particular, the defendant's reference to other advertising opportunities misses the point.
The plaintiff does not file an application. However, it can be inferred from her submission that she is requesting
the defendant's decision of October 27, 2022 to be overturned.
The defendant requests that
the action be dismissed.
His duties include, among other things, providing any data subject with information on the exercise of their rights under the GDPR upon request and dealing with complaints from a data subject. His supervisory authority also relates to all processing of personal data that falls within the scope of the GDPR. The GDPR applies to telephone numbers. The tenor of the contested decision excludes the telephone numbers of legal entities and partnerships that are not within the scope of the GDPR from the application of the decision. However, in cases where the data of a corporation or partnership reaches a natural person, the protection of the GDPR and thus also the orders of the decision apply. These are constellations in which there is a close economic connection between the company and the natural persons behind it, which is expressed in a financial and/or personal link. Such a close connection exists in the case of sole shareholders or sole partners. Furthermore, a personal reference can be made if the name of the company allows conclusions to be drawn about the partners behind it. In these cases, the processing of telephone numbers is also prohibited, or their deletion is ordered. According to Recital 26, in order for information to be classified as personal data, it is not necessary for the responsible party to be able to carry out the identification itself; it is sufficient that a third party - such as the provider of the telephone connection - can probably do this at general discretion. It is not relevant which people can actually be reached at a telephone number or which people actually use the connection in addition. As can be seen from the reasoning, the contested decision only affects the telephone numbers of the landlords, unless the plaintiff can prove that these people have previously consented to the advertising calls or that presumed consent can be assumed on the basis of specific circumstances. The plaintiff is also responsible according to Art. 4 No. 7 GDPR, because it decides on the purposes and means of data processing. In particular, it has commissioned the call center as a processor and gives it instructions on how the data is to be collected and processed by providing the software and specifications for selecting the telephone numbers to be called and telephone guides, etc. The plaintiff has made various statements about its processing of telephone numbers in various proceedings. In summary, it can be stated that as the controller, it also collects and stores telephone numbers from public sources through call center agents as employees of the processor, with the purpose of establishing initial telephone contact with the aim of making an advertising approach (cold call). Even if the telephone number is only displayed briefly on the agent's screen, processing would still have taken place, because the telephone number was found on the Internet and used to make the call. The dialer software used by the plaintiff and the call center does not use a traditional telephone system, but sets up the telephone calls using browser-based software.For this purpose, the telephone number must be temporarily stored in this software so that it can be displayed on the agent's screen and dialed. The plaintiff's advertising behavior is not automatically permissible under competition law. In order to avoid contradictions in assessment, the competition law assessment must also be taken into account when examining the legality of the data processing carried out for the purpose of telephone advertising. The assessments of the UWG therefore also flow into the balancing of interests under Art. 6 Para. 1 lit. f GDPR. In the case of advertising with a telephone call to another market participant, the balancing of interests depends on the admissibility under competition law in accordance with Section 7 Para. 2 No. 1 UWG and thus on whether it can be assumed that the latter has at least presumed consent. Since the telephone advertising approach contradicts Directive 2002/58/EC, it cannot be justified by means of Art. 6 Para. 1 lit. f GDPR. Other legal bases would also not apply, since there was no consent. The plaintiff did not provide any corresponding evidence. Against the background of the business processes described by the plaintiff herself, the existence of prior consent is also not plausible. The processing is also not covered by Art. 6 Paragraph 1 Letter b of GDPR. According to the clear wording, this only applies to data processing that is necessary to fulfill valid contracts or to carry out pre-contractual measures. Advertising measures can be part of the pre-contractual measures, but only if they initiate contract negotiations. This is not the case with cold calls in which the called party has not signaled any interest in the offer in advance. Since the plaintiff does not give the called party any opportunity to influence their rights, legal interests and interests with the telephone call, pre-contractual measures or measures that could establish a contractual relationship under Section 311 of the German Civil Code are completely ruled out. In addition, pre-contractual measures can only justify the processing of telephone numbers if they are carried out at the request of the data subject. This does not apply in the phase in which the telephone numbers are collected and used for the first advertising call. If a contract was concluded in a specific telephone call in the past or the data subject gave their consent during the telephone call, further processing of the telephone number may be permissible in existing cases. The tenor of the decision therefore stipulates that telephone numbers may be processed and do not have to be deleted if the data subject has consented or if a factual interest in the offer and advertising by telephone can be assumed. An obligation to delete data exists not only if the data subject requests this from those responsible, but also if one of the reasons listed in Art. 17 Para. 1 lit. a to f GDPR applies. Art. 17 Para. 1 lit. d GDPR is relevant here: the personal data (telephone numbers) were processed unlawfully. Only the use of telephone numbers in the cases described above is prohibited. There can therefore be no question of a quasi-professional ban.
For further details of the facts and the arguments of the parties, reference is made to the court file and the administrative procedure submitted by the defendant as well as the minutes of the oral hearing. These documents were the subject of the decision-making process.
Reasons
The chamber can decide on the action, even though the plaintiff did not appear at the oral hearing. The plaintiff was informed in the summons dated January 11, 2024, which was served on the plaintiff's legal representative on January 18, 2024, that if she did not appear, evidence could be taken, negotiations could be held and a decision could be made without her.
The action is unsuccessful. It is admissible, but unfounded.
The defendant's decision of October 27, 2022 is lawful and does not violate the plaintiff's rights (Section 113, Paragraph 1, Sentence 1 of the Administrative Court Act).
For further justification, the Chamber refers to the justification of the contested decision of the defendant, which it follows after its own examination (Section 117 Paragraph 5 VwGO). In addition, it states:
1. The legal basis for the order in Section 1 of the contested decision is Article 58 Paragraph 2 Letter f of GDPR. According to this, every supervisory authority has remedial powers that allow it, among other things, to impose a temporary or permanent restriction on processing, including a ban.
a. The order is formally lawful, in particular it is sufficiently specific.
The requirement of clarity within the meaning of Section 1 Paragraph 1 Sentence 1 VwVfG LSA in conjunction with Section 37 Paragraph 1 VwVfG requires that the will of the authority is fully expressed and that it is unambiguously clear to the addressee what legal consequence is intended. The addressee must be able to recognize what is required of him so that he can act accordingly. The administrative act must therefore not be open to different subjective assessments (Stelkens/Bonk/Sachs/Stelkens, 9th edition 2018, VwVfG § 37 marginal no. 2). However, it is sufficient if what is specifically intended can be clearly recognized from the entire content of the decision, in particular its reasoning, as well as from the other circumstances known to those involved or readily recognizable. In detail, the requirements for the necessary certainty are based on the particularities of the substantive law to be applied in each case and implemented with the administrative act (BVerwG, judgment of December 3, 2003 - 6 C 20/02 -, BVerwGE 119, 282-305, marginal no. 17). Measured against this, point 1 of the contested decision satisfies the requirement of certainty. The broad tenor, which is defined with the wording "if a specifically identifiable natural person can be reached at each of these telephone numbers", is limited by the reasoning of the decision in such a way that the plaintiff can see what is expected of her. In the reasoning of the decision (p. 8, 2nd paragraph), it is stated that a telephone number can initially be indisputably related to the subscriber. It always represents personal data within the meaning of Art. 4 No. 1 GDPR if it can be related to an identified or identifiable natural person. A person is also identifiable if the data can be assigned to a natural person using additional information, even indirectly, by simply researching the Internet. In the specific case of the plaintiff, the telephone number was collected with the aim of contacting the person authorized to make decisions for the holiday accommodation and identifying them beyond doubt in order to offer to conclude a contract. Even if the GmbH did not know the person’s name from the outset, the telephone number could be related to a natural person; the person could be identified, which was the intention from the outset. In addition, the defendant’s representative correctly pointed out during the oral hearing that the decision did not, as the plaintiff claims, make a regulation relating to every natural person who answers a telephone call. Rather, the order was in the context of the plaintiff’s room booking portal, so that paragraph 1 of the decision concerned accommodation operators. The subscriber was always identified by a telephone number; a natural person could be identified via a telephone number if further information, such as the registered address, was added and the person could therefore be identified via the telephone number, for example by means of an inverse search. This also applied to any other act of assignment or dedication, insofar as it could be traced by the person responsible for data protection, e.g. B. if the office or business connection is registered in the name of a third party, but direct lines in visible telephone lists or organizational charts are assigned to specific people or a telephone number is assigned to specific contact persons. However, there is generally no personal reference if anyone can use the connection, such as in a post office. Paragraph 1 of the decision therefore concerns natural persons who work as landlords of accommodation and who can be assigned to a specific telephone number. The Chamber agrees with these assessments and adopts them as its own. Understood in this way, the tenor meets the requirements for the specificity of administrative acts.
b. The factual requirements for the prohibition of collecting and further processing telephone numbers for the purpose of advertising if a specifically identifiable natural person can be reached at these telephone numbers and there is no prior consent or presumed consent of this person are also met.
aa. The plaintiff processed personal data.
aaa. For the purposes of the GDPR, the term "personal data" means all information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4(1) GDPR). It is generally accepted in case law and literature that the telephone number represents a personal characteristic of the subscriber in question, not only for private, but also for business and work telephone numbers (cf. only Administrative Court of Saarland, judgment of March 9, 2018 – 1 K 257/17 –, marginal no. 40, juris with further references and judgment of October 29, 2019 – 1 K 732/19 –, marginal no. 57, juris; see also Higher Administrative Court of Saarland, judgment of April 20, 2023 – 2 A 111/22 –, juris; Administrative Court of Ansbach, judgment of March 16, 2020 – AN 14 K 19.00464 –, marginal no. 22, juris; Bavarian Higher Administrative Court, judgment of March 25, 2015 – 5 B 14.2164 –, marginal no. 17, juris; VG Berlin, judgment of May 7, 2014 – 1 K 253.12 –, para. 16, juris; OVG Berlin-Brandenburg, decision of July 31, 2015 – OVG 12 N 71.14 –, para. 4, juris; BVerwG, judgment of March 17, 2016 – 7 C 2/15 –, BVerwGE 154, 231-247, para. 25; BVerwG, judgment of October 20, 2016 – 7 C 27/15 –, para. 21, juris m. w. N.; BeckOK DatenschutzR/Schild, 46th Ed. 1.11.2023, GDPR Art. 4 para. 17; Gola/Heckmann/Gola, 3rd ed. 2022, GDPR Art. 4 para. 9; Kühling/Buchner/Klar/Kühling, 4th ed. 2024, GDPR Art. 4 No. 1 para. 13). With the defendant and with a view to the protective purpose of the GDPR, the Chamber also assumes that a telephone number is also personal data of those natural persons who have intended access to the connection that can be reached under the telephone number and who can thus be identified via this intended access, such as family members living in the same household, roommates in a shared apartment or employees in the company of the connection holder, each of whom is assigned a specific extension number.
Contrary to the plaintiff's opinion, the defendant has neither prohibited the collection nor the processing of telephone numbers of legal persons with the contested decision. The tenor of the decision expressly states telephone numbers at which a specifically identifiable natural person can be reached. However, it can be assumed with the defendant that the protection of the GDPR and thus the provisions of the decision also apply in cases in which the data of a corporation or partnership affects a natural person. This is because company data that can be related to a specific natural person, as is the case with an owner-managed sole proprietorship, is also covered by the scope of protection of the GDPR (see in detail with further references Gola/Heckmann/Gola, 3rd ed. 2022, GDPR Art. 4 Rn. 28; BeckOK DatenschutzR/Schild, 46th ed. 1.11.2023, GDPR Art. 4 Rn. 6; Gola/Schomerus/Gola/Schomerus, 11th ed. 2012, BDSG § 3 Rn. 11a, beckonline). In this respect, as the defendant correctly pointed out, it is the plaintiff's responsibility to make a pre-selection of the landlords to be called. The plaintiff's argument that every company has a human, natural representative who is identifiable and tangible therefore misses the point. As already stated, the defendant's order does not generally prohibit the plaintiff from contacting natural persons. Rather, as can be seen from the contested decision and as the defendant clarified in the oral hearing, the defendant is concerned with telephone numbers to which a specific natural person can be assigned.
bbb. By collecting and storing telephone numbers or by using them to call holiday accommodation providers, personal data is processed within the meaning of Art. 4 No. 2 GDPR. Within the meaning of the GDPR, the term "processing" refers to any operation or set of operations carried out with or without the aid of automated procedures in connection with personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction (Art. 4 No. 2 GDPR). It is irrelevant whether the telephone numbers are temporarily stored by call center employees or the dialer software used, or are only briefly displayed on the screen, as this personal data is handled in any case. According to the defendant's written submission, which has not been contradicted, telephone numbers are collected by call center employees from public sources and at least briefly recorded in the dialer software for telephone calls, compared during the ongoing telephone call by asking the persons authorized to make decisions for the respective accommodation and finally, if the contract is concluded, stored for further contact or stored on a blacklist in the event that further contact is not desired. In the oral hearing, the defendant additionally noted that, according to the information available to him, the dialer software temporarily stores telephone numbers if no one or the "wrong" person is reached when attempts to call are made, in order to dial the telephone number again at a later time. In addition, both the name and telephone number are recorded in the blacklist if the person called is not interested in further telephone contact.
Ultimately, however, it is not important whether the plaintiff or the call center commissioned by it uses dialer software for the automated processing of telephone numbers, or whether telephone numbers are collected and processed analogously. This is because Article 4 No. 2 of the GDPR defines the term "processing" as "any operation or set of operations which is carried out on personal data, whether or not by automated means". In particular, the expression "any operation" shows that the Union legislator intended the term "processing" to be broadly defined, which is confirmed by the fact that the list of operations in the aforementioned provision is not exhaustive, which is expressed by the phrase "such as".
This list includes, among other things, disclosure by transmission, dissemination and "[any] other form of provision", whereby these operations can be automated or non-automated. Article 4 No. 2 of the GDPR does not set any conditions for the form of "non-automated" processing. The term "processing" therefore even covers oral transmission (cf. ECJ, judgment of 7 March 2024 - C-740/22 -, paras. 28 - 30, juris m. w. N.). The question arises whether such processing falls within the material scope of the GDPR. Article 2 GDPR, which defines this scope, stipulates in paragraph 1 that this Directive applies to the "wholly or partly automated" processing of personal data as well as to the "non-automated processing of personal data which are or are intended to be stored in a filing system". It can be inferred from this latter provision and from Recital 15 of the GDPR that the GDPR applies equally to automated as well as manual processing of personal data, so that the protection that this Regulation gives to the persons affected by the data processing does not depend on the techniques used and does not run a serious risk of being circumvented. However, it also follows that this regulation only applies to manual processing of personal data if the data processed are "stored or intended to be stored in a file" (ECJ, judgment of March 7, 2024 - C-740/22 -, paras. 33 - 34, juris with further references). The term "file" is defined broadly, in particular by including "any" structured collection of personal data. Furthermore, the requirement that the collection of personal data must be "structured according to certain criteria" only means that the data about a specific person can be easily found. Apart from this requirement, Art. 4 No. 6 GDPR does not regulate the modalities according to which a file must be structured or the form it must have. In particular, neither this nor any other provision of this regulation indicates that the personal data in question must be contained in specific card files or directories or another search system in order to affirm the existence of a filing system within the meaning of this directive (ECJ, judgment of March 7, 2024 - C-740/22 -, para. 37, juris). If the telephone numbers are not processed by call center employees using the dialer software, but are manually recorded and entered or manually placed on a "blacklist" or a "call again list", this also constitutes processing of personal data.
bb. Contrary to its opinion, the plaintiff is also responsible under data protection law and is therefore the correct addressee of the content. According to Art. 4 No. 7 HS 1 GDPR, "controller" is the natural or legal person, public authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data. The plaintiff may have commissioned a call center, i.e. a service provider, to search for suitable telephone numbers and to make the calls. However, this service provider is a processor within the meaning of Art. 28 GDPR, through which the processing is carried out on the basis of a contract or other legal instrument under Union or Member State law which binds the processor with respect to the controller and which specifies the subject matter and duration of the processing, the type and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller (Art. 28 para. 3 sentence 1 GDPR). Consequently, commissioning the call center does not release the plaintiff from its obligation to ensure and to be able to provide evidence that the processing complies with the requirements of the GDPR (cf. Art. 24 para. 1 GDPR). By commissioning the call center, the plaintiff has not renounced this responsibility, especially since, according to the documents it submitted to the defendant, it gives the service provider it commissioned instructions on the work processes in connection with contacting potential customers and on how to handle data on potential customers and objects, instructs measures in the area of data protection and provides the dialer software. It alone therefore decides on the purposes and means of data processing.
cc. If it is thus established that the plaintiff, as the data protection controller, processes personal data, this processing must meet the requirements of the GDPR.
The admissibility requirements for processing are conclusively regulated in Art. 6 (1) GDPR, with paragraphs 2 and 3 containing limited opening clauses in favor of the member states (BVerwG, judgment of March 27, 2019 - 6 C 2/18, NJW 2019, 2556 para. 44, beckonline). According to Article 6 (1) GDPR, processing is only lawful if at least one of the conditions specified in the provision is met, whereby the GDPR standardizes a prohibition subject to permission.
Contrary to its opinion, the plaintiff cannot successfully rely on the exceptions set out in Art. 6 (1) (a) to (e) GDPR, as the conditions for these are not met in the present case. In particular, the plaintiff cannot base the processing of telephone numbers on Art. 6 (1) (a), (b) and (e) GDPR.
aaa. According to Art. 6 (1) (a) GDPR, processing is lawful if the data subject has given their consent to the processing of personal data concerning them for one or more specific purposes. These conditions are not met in the plaintiff's case, as the collection and use of telephone numbers carried out by the plaintiff serve precisely to make initial contact with potential customers. The plaintiff, who in this respect has a corresponding obligation to provide evidence (Article 7 paragraph 1 GDPR, on the accountability of the controller, Article 5 paragraph 2 GDPR), has not provided corresponding evidence of consent to the collection of telephone numbers and their use for calls. The existence of such consent would also not be plausible - as the defendant correctly pointed out - in view of the business processes described by the plaintiff herself. The plaintiff also clearly does not assume that the consent of the data subjects has been given, but rather relies on the fact that consent has been presumed. However, the existence of presumed consent is not sufficient for lawful data processing within the meaning of Article 6 paragraph 1 letter a GDPR. Rather, the conditions for the effectiveness of an (express) consent must be met in accordance with Article 4 No. 11, Article 6 Paragraph 1 Letter a and Article 7 GDPR in conjunction with Recital 32 Sentence 2 and Article 42 Sentence 5 - which the plaintiff has not proven - among other things. To do this, the data subject would have to have been informed of the right to withdraw their consent at any time before giving their consent (Article 7 Paragraph 3 GDPR), which is undoubtedly not the case here. According to the plaintiff's business model, information about the rights of the data subject is only provided after a call by email, but under no circumstances before the first call. Even consent obtained by telephone – without prior consent – to prepare for a later advertising call would already constitute data processing in the aforementioned sense (cf. OVG Berlin-Brandenburg, decision of July 31, 2015 – OVG 12 N 71.14 –, paras. 4 and 11, juris).
bbb. According to Art. 6 para. 1 lit. b GDPR, the processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures that are carried out at the request of the data subject. In this case, however, it is neither about pre-contractual measures that are carried out at the request of the data subject, i.e. the person being called, nor about the performance of existing contracts. Rather, the defendant's order concerns the initiatives taken unilaterally by the plaintiff with "cold calls" to conclude a contract and thus the area of contract initiation, which, due to the lack of a request from the data subject, is not covered by the scope of Art. 6 Para. 1 lit. b GDPR (see Kühling/Buchner/Buchner/Petri, 4th ed. 2024, GDPR Art. 6 para. 36).
The argument used by the plaintiff in this respect that at least the legal institution of culpa in contrahendo should be used, whereby the application of the provision also extends to pre-contractual arrangements, is beside the point. Culpa in contrahendo describes cases of fault in the initiation of the contract and, if a pre-contractual obligation exists, opens the way to contractual damages law in the event of breaches of duty. The culpa in contrahendo therefore has nothing to do with the protection of natural persons against unauthorised data processing within the meaning of the GDPR.
ccc. According to Art. 6 (1) (e) GDPR, processing is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Processing by private individuals such as the plaintiff cannot therefore be based on this fact from the outset. The scope of the fact is rather limited, according to its wording, to official or state-initiated processing operations. Accordingly, Art. 6 (1) (e) GDPR covers data processing by authorities which they carry out in the performance of their tasks. Private individuals can only invoke this if the authority to access personal data has been vested in them in the public interest or in the exercise of official authority. They must act in place of an authority. This requires a state transfer act of some kind. A private individual cannot declare himself to be a representative of the public interest. In particular, he is not called upon to protect public safety alongside or even instead of the regulatory authorities. When protecting individual legal interests, be they his own or those of third parties, he is not pursuing public interests, but private interests (BVerwG, judgment of March 27, 2019 - 6 C 2/18, NJW 2019, 2556 para. 45 et seq., beckonline). The plaintiff's argument that taxes are generated in the context of contractual relationships is therefore clearly not convincing.
ddd. However, the collection and processing of telephone numbers, as practiced by the plaintiff, does not have a legal basis in Art. 6 para. 1 lit. f. GDPR. According to this, the processing of personal data is lawful if the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data prevail, in particular if the data subject is a child.
However, this exception does not apply in the present case, although it is not clear whether Art. 6 (1) (f) GDPR can even be used as a legal basis for data processing for the purpose of telephone advertising due to the continued validity of Art. 13 (3) of Directive 2002/58/EU11, which expressly permits member state regulations according to which telephone advertising is not permitted without the consent of the subscriber concerned. This is because the EU Commission presented a proposal for a regulation on privacy and electronic communications on 10 January 2017. The regulation is intended to replace the Data Protection Directive for Electronic Communications. However, the European Council has not yet been able to agree on a version of the so-called ePrivacy Regulation. Accordingly, due to the opening clause in Article 13 (3) of Directive 2002/58/EU, which contains regulations for unsolicited messages and expressly allows member state requirements according to which telephone advertising is not permitted without the consent of the subscriber concerned, consideration of Section 7 (2) No. 1 of the Act Against Unfair Competition could be permissible here, with the result that the scope of application of Article 6 (1) (f) of the GDPR is already not opened up (see in detail the Saarland Higher Administrative Court, judgment of April 20, 2023 - 2 A 111/22 -, para. 34, juris). The scope of the norm is not important, since the telephone advertising approach via "cold calls" practiced by the plaintiff does not in any case meet the requirements of Section 7 (2) No. 1 of the Act Against Unfair Competition. This circumstance must be included in the balancing of interests, so that a balancing of interests according to Art. 6 Para. 1 lit f. GDPR is also to its detriment.
It should first be noted that the plaintiff's objections to the defendant's consideration of the link between competition law and data protection law in the area of unfair business practices in advertising calls are not valid. The plaintiff is of the opinion that it is not the task of data protection to protect those affected from harassment that may be anti-competitive. In conclusion, the plaintiff is relying on the different protective purposes of data protection law and competition law and criticizing the fact that data protection law has no connection to competition law. The "splitting" carried out by the plaintiff in this way according to the normative protected goods does not take into account the fact that, when viewed as a whole, this is a uniform process in which personal data is used for an unauthorized advertising approach. Since the collection and processing of data is what makes unauthorized contact possible in the first place, it is also justified that the question of the legality of the use of the data collected is raised under data protection law aspects. The plaintiff cannot therefore successfully claim that the defendant is not authorized to punish violations of competition law as a data protection authority (OVG of Saarland, judgment of April 20, 2023 - 2 A 111/22 -, para. 33, juris). Regardless of this, the defendant is not concerned with enforcing competition law, but with enforcing the GDPR.
According to Section 7 (1) of the UWG, a commercial act that unreasonably harasses a market participant is inadmissible. This applies in particular to advertising, even though it is clear that the market participant addressed does not want this advertising. According to Section 7 Paragraph 2 No. 1 of the UWG, unreasonable harassment is always to be assumed in the case of advertising by telephone call to a consumer without their prior express consent or to another market participant without their at least presumed consent. The term "advertising" is not defined in the UWG or in the GDPR. According to Article 2(b) of Directive 2006/114/EC, "advertising" is any statement made in the exercise of a trade, business, craft or liberal profession with the aim of promoting the sale of goods or the provision of services, including immovable property, rights and obligations. The term telephone advertising therefore includes all calls that aim to promote the sale of goods or the provision of services (as already stated by the Saarland Higher Administrative Court, judgment of April 20, 2023 - 2 A 111/22 -, marginal no. 34, juris).
Advertising calls to consumers in so-called B2C relationships (so-called business to consumer "B2C" relationships) are therefore only permitted with their express consent, which is missing in this case, from both a competition law and data protection law perspective in accordance with Art. 6 Para. 1 lit. a, 7 GDPR, Section 7 Para. 2 No. 1 UWG, with the consumer's express consent, which is missing in this case. Advertising calls to other market participants (so-called business to business "B2B" relationships) are only permitted with their presumed consent. According to Section 2 Para. 1 No. 3 UWG, "market participants" are competitors and consumers as well as any other person who acts as a supplier or buyer of goods or services. If such declarations of intent are lacking on the part of the person addressed, advertising calls without exception constitute unreasonable harassment in accordance with Section 7 Paragraph 2 No. 1 of the Unfair Competition Act. Even if one were to assume that the advertising relates to the professional activity of the person addressed and thus to the B2B sector, there is no presumed consent within the meaning of Section 7 Paragraph 2 No. 1 of the Unfair Competition Act on the part of the holiday accommodation landlords addressed. The Federal Court of Justice rejects a blanket approach to making the admissibility of telephone advertising dependent on whether it relates to the actual business of the person being called (BGH, judgment of March 11, 2010 - I R 27/08 -, juris). It is necessary, but also sufficient, that the caller can assume ex ante, taking into account all the circumstances of the individual case, that the person being called will have a factual interest in the telephone advertising, for whatever reasons. It is not enough that the caller can assume that there is a current or specific need for the goods or services on offer; it must also be the case that the person called will presumably consent to telephone advertising (LG Heilbronn, judgment of January 4, 2013 – 8 O 261/12 Ka –, para. 35, juris). On the question of when presumed consent can be assumed, the Federal Court of Justice has stated that the assessment must be based on circumstances prior to the call and on the type and content of the advertising (BGH, judgment of March 11, 2010 – I ZR 27/08 –, para. 21, juris). It must be possible to assume that the person called has a factual interest based on concrete factual evidence (BGH, judgment of January 25, 2001 – I ZR 53/99 –, para. 18, juris). An objective interest could exist, for example, if the company called needs the goods or services on an ongoing basis for production. It could also be a factor whether this type of telephone approach is common within the respective industry. However, a mere factual relevance is not sufficient to assume that the entrepreneur called has consented (for the ruling, see OVG of Saarland, judgment of April 20, 2023 - 2 A 111/22 -, para. 34, juris).
Based on this, it cannot be established that landlords of accommodation have an objectively justified interest in an advertisement on the plaintiff's portal. Contrary to the plaintiff's opinion, this cannot be concluded from the fact that the plaintiff offers customers a free trial period, which, according to the plaintiff, is not available from any other advertising provider, and that only low costs are incurred for publishing an advertisement. The free trial period is designed to allow customers to get to know the portal and then decide to place a paid ad after the trial period has ended. Consequently, calls that primarily concern the free offer are also advertising calls within the meaning of Section 7 Paragraph 2 No. 1 of the Act Against Unfair Competition (cf. BGH, judgment of September 20, 2007 - I ZR 88/05 -, para. 16 et seq., juris). The fact that the landlords of accommodation have stored their telephone numbers in publicly accessible sources does not constitute presumed consent. This primarily serves to ensure that the accommodation can be reached by potential tenants. In this respect, it is irrelevant whether the accommodation provider itself also uses this telephone number for questions about technical and other purposes in connection with the accommodation provider. The publication of advertisements on the plaintiff's portal is neither typical nor essential for the rental of holiday accommodation, given the wide range of options available to landlords to advertise their accommodation. It is not clear why the plaintiff can expect that all landlords of holiday accommodation would be interested in placing an advertisement on her portal. As explained, the plaintiff's offer is only one of many. The Chamber cannot see that it is particularly well known, nor has the plaintiff presented this. The plaintiff cannot claim that her type of advertising is successful and has led to a large number of business contacts. The fact that anti-competitive behavior leads to business success for the advertiser does not justify the legality of this behavior (VG Saarlouis judgment of December 15, 2021 - 5 K 461/20, BeckRS 2021, 61885 para. 40, beckonline). In addition, it can be assumed, as the defendant does, that the presumed consent of the landlords of holiday accommodation is also contradicted by the interest in being reachable for potential tenants. For the duration of the plaintiff's advertising calls, which is not insignificant in view of the conversation guide included in the administrative process, the landlord in question is just as unreachable for short-term or spontaneous inquiries from potential tenants as for any urgent matters that tenants staying in the accommodation would like to clarify by telephone.
The fact that business models such as the telephone advertising carried out by the plaintiff violate Section 7 Paragraph 2 No. 1 of the Unfair Competition Act was also accepted by the LG Flensburg (judgment of April 8, 2022 - 8 O 7/22, juris) and, following it, the OLG Schleswig-Holstein (decision of June 20, 2022 - 6 U 29/22 and decision of August 8, 2022 - 6 U 29/22) in connection with a civil law claim for injunctive relief in the individual case under consideration there.
After all of this, the plaintiff cannot argue in her favor that, if the person called does not want to be contacted again, the respective telephone number is stored in a blacklist in order to avoid further calls. In this regard, the defendant correctly noted that the processing of personal data in a blacklist also requires its own legal basis, which is present if the blacklist serves to implement objections from those called against otherwise lawful advertising calls, i.e. if the requirements of Art. 6 Paragraph 1 Letter f of GDPR are initially met. This is undoubtedly not the case here. A "blacklist" cannot justify a violation of data protection law.
c. Errors of discretion with regard to the instructions in Section 1 of the contested decision are not apparent.
According to Recital 129, Sentence 5 of the GDPR, any measure with regard to ensuring compliance with this regulation should be suitable, necessary and proportionate, taking into account the circumstances of the individual case.
Measured against this, the defendant's instruction in Section 1 of the contested decision also proves to be proportionate.
Since no less drastic measure that would also be suitable for eliminating the violation is apparent, there is no objection to the defendant instructing the plaintiff to refrain from collecting and further processing telephone numbers for the purpose of advertising if a specifically identifiable natural person can be reached at these telephone numbers. In particular, the defendant excluded from his instruction those cases in which the plaintiff has the prior consent of the person concerned or in which the consent of the person concerned can be assumed. Since the plaintiff's legal violation cannot be eliminated in any other way, the contested order does not raise any legal concerns with regard to proportionality in the narrower sense, especially since the plaintiff is free to use other forms of advertising - for example in the form of letters, advertisements, etc.
To the extent that the plaintiff claims that the prohibition of collecting and processing telephone numbers is a kind of professional ban, the Chamber cannot agree with this. The plaintiff is still fundamentally able to process the telephone numbers of legal entities, to process the telephone numbers of specifically identifiable natural persons if appropriate consent or presumed consent is available, and to use other means of advertising. In principle, it is also not prevented from processing personal data and making advertising calls within the framework of existing business relationships (see below under 3.). Since the plaintiff itself states that there are a large number of concluded and implemented contracts, a forced cessation of the plaintiff's business by the defendant's decision is not obvious. Irrespective of this, the defendant would be obliged to demand that the plaintiff eliminate existing legal violations due to its obligation to monitor and enforce the GDPR arising from Art. 57 Para. 1 lit. a GDPR even if its instruction was accompanied by a professional ban. This applies all the more if a business model - as here - violates fair competition anyway.
2. Paragraph 2 of the contested decision is based on Article 58, paragraph 1, letter a of the GDPR. According to this, every supervisory authority has the power to instruct the controller, the processor and, if applicable, the representative of the controller or the processor to provide all information necessary for the performance of their tasks. In this respect, the supervisory authority also has the power to act by administrative act, which is already expressed in the wording of the provision ("to instruct"). In addition, it is also generally within the discretion of an authority to specify an existing obligation to act (in this case the plaintiff's obligation to provide evidence) by administrative act and then to enforce it by means of administrative coercion (VG Mainz, judgment of May 9, 2019 - 1 K 760/18.MZ -, para. 36, juris).
The instruction to prove when the plaintiff took which measures to implement No. 1 of the decision within 2 weeks of the decision becoming final not only serves to clarify the facts, but also to monitor the prohibition imposed on the plaintiff in No. 1 of the decision and the exceptions provided for.
There is no legal objection to this, especially since the plaintiff is already subject to an obligation to provide accountability and an obligation to provide evidence of the consent of data subjects to the processing of their personal data based on the requirements in Art. 7 Para. 1, 5 Para. 2 and 4 No. 11 GDPR.
There are no discernible errors of discretion. The Chamber also has no doubts about the proportionality of the measure ordered in No. 2 of the contested decision.
The length of the deadlines set for the plaintiff to implement the ordered measure also raises no legal concerns in view of the defendant's considerations arising from the contested decision. The plaintiff herself does not state that it is not possible for her to implement the instruction within the set deadline.
3. The instruction in paragraph 3 of the contested decision finds its legal basis in Article 58 paragraph 2 letter g of the GDPR. According to this provision, the supervisory authority is empowered, among other things, to order the deletion of personal data.
The defendant issued a corresponding instruction, although - contrary to the plaintiff's representation - it did not order the deletion of all telephone numbers in its inventory.
Rather, in addition to the exceptions listed in the tenor of the decision, the defendant expressly clarified in the reasons for the contested decision that the instruction - meaning the decision as a whole - does not include telephone numbers that can be assigned to natural persons from whom the plaintiff can prove prior consent with regard to the advertising calls or with whom it already has a business relationship. A business relationship is understood to mean those that are related to an advertisement on the plaintiff's website or that indicate a factual interest of the person concerned in an advertisement on these websites and can therefore be assumed that the person is expecting this call or at least has a positive attitude towards it. The instruction also expressly does not include advertising to legal persons insofar as their name and contact details cannot also be related to a natural person (page 16, last paragraph and page 17, 1st and 2nd paragraphs of the decision). Consequently, cases in which a contract has already been concluded or in which a contract is being initiated at the request of the person concerned are excluded from the deletion instruction. The instruction in section 3 of the contested decision therefore only covers the data that was collected before such a contract was initiated ("collected for the purposes of advertising"). In this respect, the defendant also clarified in the oral hearing that it only concerns the data that was obtained from illegal telephone calls and remained because it was stored in the dialer software or kept for the purpose of re-calling. This means that it only concerns data that is stored without a legal basis anyway. However, there is a legal basis for contracts (Article 6, Paragraph 1, Letter b, Section 1 of the GDPR), even if these contracts were originally initiated in violation of data protection regulations.
There are also no discernible errors of discretion with regard to the instruction in Section 3 of the contested decision. In addition, the instruction proves to be proportionate.
Since there is no apparent less drastic measure that would also be suitable for eliminating the violation, there is no objection to the defendant instructing the plaintiff to delete data that has already been collected and stored. In particular, the defendant has excluded from his instruction those cases in which the plaintiff has the prior consent of the data subject or in which the consent of the data subject can be assumed. The cases in which telephone numbers were collected not only for the purposes of advertising, but for the purpose of initiating a contract at the request of the data subject or for the performance and processing of existing contracts are also excluded from the instruction, as the defendant expressly clarified again in the oral hearing. Since the plaintiff's legal violation cannot be remedied in any other way than by deletion, the contested order does not raise any legal concerns with regard to proportionality in the narrower sense.
To the extent that the plaintiff also claims with regard to the deletion instruction that this represents a quasi-professional ban, the Chamber is still unable to accept this. The plaintiff is fundamentally not prevented from processing personal data if the corresponding consent has been given and within the framework of existing business relationships. As explained, these are precisely not covered by the deletion instruction. Since the plaintiff argues that there are a large number of contracts, the deletion of the data recorded by the instruction in section 3 is unlikely to have a significant impact, especially if the plaintiff is prevented from contacting the persons listed there again due to storage on the blacklist.
The length of the deadlines set for the plaintiff to implement the ordered measure does not raise any legal concerns in view of the defendant's considerations arising from the contested decision. The plaintiff also does not argue with regard to the deletion instruction that it is not possible for it to implement it within the set deadline.
4. Section 4 of the contested decision, like section 2 of the contested decision, is based on Art. 58 (1)(a) GDPR. The instruction to prove to the defendant, within 2 weeks of the decision becoming final, when and which measures it took to implement section 3 of the instruction cannot be legally challenged. For further justification, reference is made to the statements under 2.
5. The threat of a penalty contained in section 5 of the contested decision is also not legally objectionable.
6. Contrary to the plaintiff's opinion, the number of complaints on which the defendant becomes aware of data protection violations is not relevant for the defendant to take action. He is also obliged, regardless of specific complaints, to monitor and enforce the application of the GDPR in his territory (Article 57, paragraph 1, letter a, GDPR). Article 57, paragraph 1, letter h, GDPR gives the data protection supervisory authorities the general task of conducting "investigations into the application of this Regulation", i.e. intervening ex officio to ensure compliance with the GDPR; a similar ex officio investigation obligation is contained at European level in Article 46, letter b, Regulation (EC) No. 45/2001 for the European Data Protection Supervisor. A national data protection supervisory authority can obtain the information required for such an investigation from its own knowledge, e.g. when employees of the supervisory authority learn of possible violations of data protection law (Ehmann/Selmayr/Selmayr, 2nd edition 2018, GDPR Art. 57 Rn. 9). Consequently, there is nothing to object to the fact that the defendant did not limit himself to processing specific complaints, but also conducted further investigations, in particular in various Internet forums, especially since he disclosed these investigations to the plaintiff.
The defendant is also, without contradiction, the supervisory authority responsible under state law (Art. 4 No. 21 GDPR in conjunction with Art. 51 GDPR in conjunction with Section 40 Para. 1 BDSG in conjunction with Section 22 Para. 1 DSAG LSA), in whose area of responsibility the plaintiff is based.
7. The decision on costs is based on Section 154 Paragraph 1 of the Administrative Court Act. The decision on provisional enforceability is based on Sections 167 of the Administrative Court Act, 708 No. 11, 711 of the Code of Civil Procedure.
DECISION:
The value of the subject matter of the dispute is set at EUR 12,000.00.
Reasons:
The determination of the value in dispute is based on Section 52 Paragraph 1 of the Administrative Court Act. Based on Section 1.7.2 of the Catalogue of Values in Dispute for Administrative Jurisdiction and in view of the fact that the default value in dispute would have to be determined for the basic order in accordance with Section 52 Paragraph 2 of the Administrative Court Act, but the basic order threatens to impose fines totaling EUR 12,000.00, the Chamber considers it appropriate to determine the value in dispute at this amount.
