Court case 1 A 217/22 MD – Court Ruling (Germany, 2024)

The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted. Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller. After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call. Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order. In addition, the DPA ordered the controller under Article 58(1)(a) GDPR to demonstrate to the DPA the compliance with the orders by showing which measures were taken. In case of non-compliance the DPA threatened an administrative fine. The controller appealed this order before the Administrative Court Magdeburg (Verwaltungsgericht Magdeburg – VG Magdeburg). The court dismissed the controller’s appeal. The only possible legal ground for the processing of personal data in this case is Article 6(1)(f) GDPR. But in this case the processing cannot be based on Article 6(1)(f) GDPR. The court held that cold calling might fall out of the scope of application of Article 6(1)(f) GDPR because Article 13(3) of the Directive 2002/58/EC (ePrivacy Directive) in conjunction with [https://dejure.org/gesetze/UWG/7.html#Abs2:Nr1 § 7(2)(1) German law against unfair competition (Gesetz gegen den unlauteren Wettbewerb - UWG)] could be lex specialis. § 7(2)(1) UWG states that advertising by means of a telephone call made to a consumer without his or her prior express consent, or made to another market participant without at least the latter’s presumed consent constitutes an unacceptable nuisance to a market participant and is illegal. However, the court’s decision does not depend on this question since the processing of personal data in this case also fails the balancing test under Article 6(1)(f) GDPR. This is due to the fact that the processing of phone numbers for cold calling purposes fails to match the criteria of § 7(2)(1) UWG which can be taken into consideration. The court dismissed the controller’s argument that German competition law and the GDPR had different purposes and therefore, the DPA should not enforce competition law through the application of Data protection law. The court argued that an overall view would lead to the conclusion that it the cold calling was a uniform process in a way that the processing of personal data has the purpose of illegal cold calling. Therefore, the controller cannot argue that the DPA was not competent to enforce competition law.