View source for VG Wiesbaden - 6 K 996/22.WI

{{COURTdecisionBOX

|Jurisdiction=Germany
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=VG Wiesbaden
|Court_Original_Name=Verwaltungsgericht Wiesbaden
|Court_English_Name=Administrative Court Wiesbaden
|Court_With_Country=VG Wiesbaden (Germany)

|Case_Number_Name=6 K 996/22.WI
|ECLI=

|Original_Source_Name_1=VG Wiesbaden
|Original_Source_Link_1=https://gdprhub.eu/images/1/14/2025_Einstellungsbeschluss_Redacted.pdf
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=25.11.2025
|Date_Published=
|Year=2025

|GDPR_Article_1=Article 5(1) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1
|GDPR_Article_2=Article 9(1) GDPR
|GDPR_Article_Link_2=Article 9 GDPR#1
|GDPR_Article_3=Article 25(1) GDPR
|GDPR_Article_Link_3=Article 25 GDPR#1
|GDPR_Article_4=
|GDPR_Article_Link_4=
|GDPR_Article_5=
|GDPR_Article_Link_5=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=paydirekt GmbH
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_From_Body=HBDI (Hesse)
|Appeal_From_Case_Number_Name=90.22.73:0051
|Appeal_From_Status=
|Appeal_From_Link=https://gdprhub.eu/index.php?title=HBDI_(Hesse)_-_90.22.73:0051
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Not appealed
|Appeal_To_Link=

|Initial_Contributor=dt
|
}}

A court found that a payment service's processing of items purchased online (such as items purchased at an online pharmacy or sex shop) can constitute sensitive data under Article 9(1) GDPR.

== English Summary ==

=== Facts ===
The data subject purchased eye drops, skin care products, and other similar products from on online pharmacy website, as well as items from an online sex shop website. 

The data subject used the online payment service provided by Paydirekt GmbH (the controller) when making the online purchases.

The controller stored data regarding the items purchased, along with the amount of money spent and the date of the purchases. 

The data subject, represented by ''noyb'', filed a complained with the Hesse DPA (HBDI) in which she argued that the controller violated [[Article 5 GDPR#1|Article 5(1) GDPR]] and [[Article 9 GDPR#1|Article 9(1) GDPR]] by processing health-related data and data relating to her sexual life (both sensitive data) without a legal basis - specifically by storing the information on the individual items purchased, and [[Article 25 GDPR#1|Article 25(1) GDPR]] by processing data that were not needed for the provision of the payment services (data minimisation).

The DPA partially rejected the complaint, finding that the controller can process information on the items purchased by a customer from an online pharmacy and an online sex shop based on its legitimate interest to minimise mid-transaction payment cancellations and for fraud prevention purposes. Furthermore, the DPA held that the specific information on purchased items is not sensitive data. 

In August 2022, the data subject appealed against the DPA's decision in court, requesting that the decision be revoked and that the DPA prohibit the controller from processing the purchased items when making a purchase. 

Following the CJEU judgement in C-21/23 [[CJEU - C‑21/23 - Lindenapotheke|EuGH]] the DPA changed their position on the classification of these data to be partially sensitive data. However, the DPA did not provide a detailed explanation as to the consequences of this change of position. 

In 2025, the controller entered liquidation proceedings and ceased operations.

=== Holding ===
The Court noted that the controller ceased operations, entered liquidation and claimed to have deleted the data subject’s data. 

Therefore, during the previous oral hearing it had informed the data subject of the option of withdrawing her appeal for lack of an object or to have the case dismissed. The parties had then agreed that the case is without object.

However, the Court carried out a brief assessment of the outcome of the appeal in order to decide on the costs of the proceedings. 

The Court noted that the appeal would have been successful had it not been left without an object. 

In particular, the Court held that basing the data processing of purchased items on a legitimate interest to minimise mid-transaction payment cancellations would not be covered by [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]].

In addition, the Court doubts the lawfulness of the processing for fraud prevention purposes, as other less restrictive means would be available.

Finally, the Court held that even the DPA conceded during the proceedings that some data may be sensitive data (Article 9 GDPR), meaning the DPA’s standard of review in its decision was flawed.

Therefore, the Court ordered the DPA to cover the costs of the proceedings.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
Reasons

Since the parties have unanimously declared the main issue of the legal dispute settled, the costs of the proceedings must be decided upon at the court's discretion, taking into account the previous state of the case and the legal arguments (§ 161 para. 2 sentence 1 VwGO [German Code of Administrative Procedure]). As a rule, it is equitable to impose the costs of the proceedings on the party who, without the settlement, would likely have lost upon only a summary examination of the facts and the law, or who brought about the settlement of the legal dispute of their own volition (Federal Administrative Court, decision of February 2, 2006 – 1 C 4/05 –, juris, para. 2). The question, therefore, is who would likely have won the case
- 3 -
6 K 996/22.WI
had the event rendering the case moot not occurred (cf. Federal Constitutional Court, decision of December 25, 2016 – 1 BvR 1380/11 –, juris, para. 13).

In this review, the court is relieved, for reasons of procedural economy, of the obligation to make further findings, gather evidence, and clarify difficult legal questions that would have been necessary for a final decision, solely with regard to the still-pending decision on costs. The depth of review is significantly reduced compared to the main proceedings, both factually and legally. The wording of Section 161 Paragraph 2 of the Code of Administrative Court Procedure (VwGO), with its focus on the "previous" state of the facts and the legal issues, already prohibits further clarification of the facts. From a legal perspective, only a summary review based on the submitted arguments is to be conducted (see Wysk, in: Wysk, VwGO, 4th ed. 2025, § 161, para. 33 with further references). If the prospects of success are uncertain, it is generally appropriate to divide the costs equally (see Schoch/Schneider/Clausing, 42nd supplement February 2022, VwGO, § 161, paras. 22 et seq.). If the prospects of success of the legal remedy are difficult to assess, the aspect of which party's sphere of responsibility the occurrence of the event rendering the case moot may also be considered in the discretionary deliberations, provided there is a sufficient connection to the facts (see also Higher Administrative Court of North Rhine-Westphalia, decision of March 6, 2019 – 1 B 113/19 –, juris).

















] † ... The supervisory authority's decision is subject to substantive review by the court, which, however, can only be summary in this case, as explained above. The court must examine whether the supervisory authority has adequately investigated whether a violation of the GDPR has occurred. In order to assess whether data processing is unlawful and whether supervisory measures are required, the supervisory authority must investigate the facts and clarify all circumstances necessary for identifying and verifying the violation. Article 58(1) GDPR grants the supervisory authority extensive investigative powers. What constitutes an "adequate scope" of investigation under the principle of official investigation is not defined. Recital 141, second sentence, of the GDPR implies that, subject to judicial review, the investigation should go as far as
- 4 -
6 K 996/22.WI
is appropriate in the individual case. The scope of the investigation is determined in particular by the individual significance of the matter and the severity of the alleged infringement. According to the case law of the European Court of Justice (ECJ), the investigation must be carried out to a reasonable extent and with all due diligence (see ECJ judgments "Facebook Ireland and Schrems" of 16 July 2020 – C-311/18 –, EU:C:2020:559, para. 111, and SCHUFA Holding of 7 December 2023 – C-26/22 –, EU:C:2023:958, para. 56). It must be borne in mind that the supervisory authority is obliged to enforce the GDPR pursuant to Article 57(1)(a) GDPR. If, at the end of its investigation, the supervisory authority identifies a violation of the GDPR, it is generally required to take remedial measures aimed at remedying the violation. Article 58(2) GDPR provides a list of possible measures. The supervisory authority must exercise its discretion to decide whether exercising a less severe remedy is sufficient to ensure the application and enforcement of the GDPR, or whether it needs to escalate to a higher level. It is not obligated to always proceed in the exact order of the remedies listed in Article 58(2) GDPR, but may, in the interest of the effective enforcement of European data protection law, also immediately exercise a more severe remedy if this appears objectively necessary and proportionate (see Selmayr, in: Ehmann/Selmayr, GDPR, 3rd edition 2024, GDPR Art. 58 para. 18).

Based on the foregoing, and considering the current state of the facts and the legal arguments, the summary review required here, as of the relevant date of the event rendering the case moot – namely, the cessation of operations by the intervener on December 31, 2024, and the deletion of the shopping cart information as well as all remaining transaction and customer data of the plaintiff by the intervener – indicates that the plaintiff's request for legal protection, which aimed to compel the defendant, by setting aside the defendant's decision of July 22, 2022, to intervene with supervisory measures against the intervener in order to prevent the contents of the electronic shopping cart from being disclosed to the intervener during online purchases by the plaintiff in the online mail-order pharmacy www.delmed.de and the online erotic shop www.mysticstore.com, would likely have been successful.

5 -
6 K 996/22.WI

Case No. 6 K 996/22.WI While the defendant did not remain entirely inactive in response to the plaintiff's complaint, he did ensure that the third party ceased processing the data for the purposes of displaying shopping cart information in the transaction overview for the user and for displaying shopping cart information to the third party's customer service staff with a new release in spring 2023, and that the data was no longer processed. Furthermore, he ensured that the plaintiff's corresponding data was deleted. In this respect, the defendant correctly assumed that the fundamental interest of the data subjects in preventing the processing outweighs the third party's interest in processing it.

However, based on the summary review of the facts and the law required here—and sufficient—the contested decision proves to be flawed in its exercise of discretion, at least insofar as the defendant likely failed to recognize that the data processed by the third party in the plaintiff's case must be assessed differently in terms of its eligibility for protection than initially assumed by the defendant.

The defendant argued in the contested decision that the data processing by the intervener for the purpose of displaying the shopping cart when the user places an order and makes payment was lawful pursuant to Article 6(1)(f) GDPR. The defendant's view that the intervener's business interest in the smooth and competitive operation of its payment service—i.e., the interest in displaying the shopping cart during payment confirmation to reduce the cancellation rate—outweighs the plaintiff's interest or fundamental right to informational self-determination within the framework of the balancing of interests required by Article 6(1)(f) GDPR is not convincing. After all, the defendant assumed that displaying the shopping cart for payment confirmation does not require long-term storage,

6 K 996/22.WI
and therefore the storage period will be shortened in the future. He ensured that, for this purpose, the shopping cart information would only be stored for 48 hours after the new release went live in spring 2023 and then deleted.

Furthermore, the defendant's assumption in the contested decision that the interveners' access to the shopping cart information is necessary for fraud prevention is subject to serious reservations. Based on the interveners' merely general statements, it is not readily apparent that their legitimate interest in fraud prevention could not be addressed by other, less intrusive means, such as allowing access only to the number of products or their item numbers instead of the product names.


Furthermore, the defendant's assumption in the contested decision that the interveners' access to the shopping cart information is necessary for fraud prevention is also subject to serious reservations. Finally, it is doubtful whether the legal opinion expressed by the defendant in the contested decision, namely that the application of Article 9(1) GDPR is precluded because the data in question do not constitute special categories of personal data, remains tenable in light of the broad interpretation of the term "health data" within the meaning of Article 9(1) GDPR indicated by the Court of Justice of the European Union (CJEU, Judgment of 4 October 2024 – C-21/23 –, paras. 81 et seq.).

However, the Chamber can leave this question open. While, in light of the aforementioned case law of the CJEU – contrary to the assumption in the contested decision – it cannot be ruled out from the outset that at least some information about the products purchased by the plaintiff from the online pharmacy could be classified as health data within the meaning of Article 9(1) GDPR and thus be subject to the general prohibition on processing established by this provision. The defendant himself admitted this in the court proceedings (in particular in the written submission of December 23, 2024, relating to the product children's nasal spray). The defendant also admitted in the court proceedings and in the oral hearing that the broad interpretation of Article 9(1) GDPR supports the conclusion that the items purchased by the plaintiff on January 24, 2024, from the online sex shop also fell within the scope of protection of the aforementioned provision. However, the defendant thereby admitted that the standard of review he adopted in the contested decision was flawed. In this respect, the defendant, by generally denying the scope of application of Art. 9 GDPR in the contested decision of July 22, 2022, misjudged the scope of the data processing operation of the intervener and the need for protection of the data processed by the intervener in the case of the plaintiff.
The defendant's discretionary considerations were therefore likely legally flawed, which is why the plaintiff would probably have been entitled to (further) supervisory intervention by the defendant at its proper discretion with respect to the intervener.

However, whether the action had any prospect of success in the main claim cannot currently be affirmed or denied with sufficient certainty. Loss in this respect, however, appears to be minor within the meaning of Section 155 Paragraph 1 Sentence 3 of the Code of Administrative Court Procedure (VwGO). In any case, the alternative claim 1, which aims at a new decision, has a preponderance of prospects of success in view of the errors of discretion in the contested decision.

Based on the above considerations, it is equitable in this case within the meaning of Section 161 Paragraph 2 Sentence 1 of the Code of Administrative Court Procedure (VwGO) to order the defendant to bear the costs of the proceedings.

No costs can be imposed on the intervener, as she did not file an application (§ 154 para. 3 VwGO [German Code of Administrative Procedure]). Because she did not participate in the risk of costs, it is equitable to refrain from ordering the reimbursement of her extrajudicial costs (§ 162 para. 3 VwGO).

- 8 -

6 K 996/22.WI
Since the facts and circumstances of the case do not provide sufficient grounds for determining the value in dispute, the value in dispute was finally set at EUR 5,000.00, § 52 para. 2 GKG [German Court Costs Act]. The preliminary determination of the value in dispute is therefore rendered moot.

Legal Notice

This decision is final, with the exception of the decision on the value in dispute.

An appeal may be lodged against the determination of the value in dispute if the value of the subject matter of the appeal exceeds EUR 200.00 or if the court has granted leave to appeal.

The appeal must be filed in writing or recorded by the clerk of the court at the
Administrative Court Wiesbaden,
Mainzer Straße 124,
65189 Wiesbaden. Legal representation is not required in these proceedings.

The appeal is only admissible within six months of the decision in the main proceedings becoming legally binding or the proceedings otherwise being concluded.
</pre>