Court case 10 O 14/21 – Court Ruling (Germany, 2023)

The controller operates several websites. The data subject stated that, as a consumer, he ordered household goods from the controller's online shop in 2020, giving his name and address. According to the data subject, the controller violated data protection law in several ways. He stated that the controller had deliberately integrated malware into its site, which manipulated the data subject's internet browser. Thereby, personal data had been unlawfully processed by the controller itself, as well as being irrevocably forwarded to foreign third party companies in order to track his online behaviour by setting cookies without his consent. Due to the alleged violations, the data subject claimed to be entitled to injunctive relief for infringement of Article 6(1) GDPR. Furthermore, he argued the infringement of Article 26 GDPR (joint responsibility) and Article 44 GDPR (third country transfer). The controller argued that the data subject had not sufficiently substantiated his claim since he had neither specified the processing of his data that allegedly took place nor described it accurately. Moreover, according to the controller, there is no basis for a claim because the GDPR does not provide for injunctive relief under civil law. The Regional Court Wiesbaden found the data subject's action both inadmissible and unfounded. First, the court stated that the data subject's claim was not sufficiently specific as it did not specify what exact behaviour he wanted to prevent with the injunction. Then, the court added that the lack of specification of the exact data processing activity also made the claim unfounded as the data subject had not even given information on what and when he ordered in what specific online shop of the controller. To the court it was clear that the data subject was not concerned with being affected in a specific case where he saw his personal rights violated, but rather a fundamental abstract clarification. There had been no pre-judicial correspondence in the case at hand, which would have been required in order for the controller to be able to defend itself. Finally, the court agreed with the controller that the GDPR does not provide for injunctive relief under civil law. According to the court, there was no basis for the claim under Article 6 GDPR and Article 44 GDPR. It held that for a civil law claim, it is in not sufficient that there are regulations in the sense of permission or prohibition norms, but that there must be a norm that formulates a subjective claim for the individual and can thus be used as a basis for asserting a claim. Article 17 GDPR, which would give the data subject individual rights, was not applicable as it did not match the data subject's objective. While § 1004 BGB generally allows for injunctive relief, the court did not see any room for application because the cases for claims under the GDPR are exhaustive.