Facebook – Court Ruling (Germany, 2024)

The controller operates the social network Facebook. The data subject is a Facebook user. On the 16 September 2021, the data subject re-posted another user’s post on the alleged ineffectiveness and dangers of Covid-19 vaccinations, claiming the “studies published by the CDC, the British government and Oxford University have shown that Covid-19 vaccines are ineffective”. On the same day, the controller removed this post and informed the data subject about this deletion who then appealed the decision without giving further reasons. The controller, however, did not change its decision. The controller’s terms and conditions stipulated that all violations against the community standards expire after one year. With his lawsuit, the data subject demanded, inter alia, * the rectification of his data saved with the controller insofar as all deletion and blocking entries from the controller’s system should be deleted and the counter that counts them should be reset; * decide, by way of a declaratory judgement, that the controller was not allowed to remove the post and confer on the data subject any kind of blocking; * the unblocking of said Facebook post; * €50 in damages. The Regional Court (Landgericht Frankfurt – LG Frankfurt) dismissed the lawsuit completely. The data subject then appealed the decision to the Higher Regional Court Frankfurt (Oberlandesgericht Frankfurt – OLG Frankfurt). The OLG Frankfurt held that the controller had to delete all deletion and blocking entries older than 1 January 2021 and the entry referring to the 16 September 2021 and to reduce the respective counter accordingly. Furthermore, the OLG partially granted the data subject pre-court lawyer costs; the rest of the appeal was dismissed. = The legal basis for the deletion claim follows from Article 17(1)(a) GDPR. The controller was not able to demonstrate the necessity of the further processing of these data since the violations expired after one year according to the terms and conditions of the controller. After this deadline, violations cannot be used for sanctions anymore, so there was no reason to further retain these personal data. The court did not accept the controller’s explanation that the further retention of the data was necessary for quality management purposes. = However, a legal basis for further retention could arise from Article 17(3)(e) GDPR (establishment, exercise or defence of legal claims). This applied for possible future lawsuits. Thus, the blocking entries the controller saved for the year 2021 did not yet have to be deleted (except for the one on the 16 September 2021 because this was already part of this very lawsuit, hence, a future lawsuit could not arise). Because possible claims from before 2021 fell under the statute of limitations, the controller also could not rely on Article 17(3)(e) GDPR regarding these claims. The entries concerning the year 2021 were also not subject to erasure under Article 16(1) GDPR because they were not inaccurate. Rather, the entries were reporting the blockings and this was factually true. = The action for a declaratory judgement was not admissible under [https://www.gesetze-im-internet.de/zpo/__256.html § 256 of the Civil Process Order (Zivilprozessordnung – ZPO)]. This was due to the subsidiarity of declaratory judgements. The court held that a declaratory judgement was not necessary since the data subject could also sue for performance or injunction. The court also dismissed the claim for unblocking the said posting because the blocking was at least lawful under the new terms and conditions in conjunction with the community guidelines from 2022, which were lawful and valid and were forbidding fake news in the section “dangerous health information”. The court held that the postings contained “misinformation about vaccines” under the post-2022 guidelines, because public authorities had concluded this information was wrong and likely to lead to refusal of vaccinations. The court held that the controller had sufficiently shown that studies and public authorities had confirmed the effectiveness of the vaccinations. The court however explicitly did not decide whether the blocking was also legal under pre-2022 guidelines. However, there was still no right to demand unblocking, because at least they would be subject to new blocking under the new guidelines. Thus, under the dolo agit principle from [https://www.gesetze-im-internet.de/bgb/__242.html § 242 German Civil Code (Bürgerliches Gesetzbuch – BGB)]. = However, the court noted, that in the light of the right to freedom of expression under [https://www.gesetze-im-internet.de/gg/art_5.html Article 5(1) of the German Basic Law (Grundgesetz – GG)] also criticism of government policies, authorities and health organisations must be possible. This was due to the indirect third-party effect of fundamental rights (mittelbare Drittwirkung). The court agrees that there were no absolute truths and science relied on the constant questioning of previous knowledge and that scientific knowledge can still be subject to falsification. Therefore, an objective, fact-based criticism could not be deleted under the community guidelines of the controller. However, the criticism in the present case was found not to be objective or fact-based. = The court dismissed the claim for damages since there were no material as well as non-material damages. A material damage was not shown by the data subject. A non-material damage under Article 82(1) GDPR also required a minimum threshold of infringement that was not reached. A sole feeling of unease was not enough for a non-material damage.