Court case 6 C 3.23 – Court Ruling (Germany, 2025)

The controller purchases dental gold from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The controller uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the controller. Following a dentist's report, the DPA ordered the controller to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the DPA ordered the deletion of the data collected and stored for this purpose and instructed the controller to implement the ordered measures within two weeks of the order becoming final and to notify the DPA thereof. The controller applied to the DPA for annulment of the decision. As grounds, it essentially argued that her conduct was lawful under the GDPR, which had since entered into force, so that a new issuance of the order would not be possible. The DPA rejected the application, essentially stating that the legal situation had not changed in the controller's favor. The Administrative Court dismissed the controller's action seeking an order requiring the DPA to annul its decision. The Higher Administrative Court held that in the absence of consent under Article 6(1)(a) GDPR, the admissibility of the controller's data processing for direct marketing purposes now depends on the applicability of Article 6(1)(f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other. However, the requirements of Article 6(1)(f) GDPR are not met because the telephone advertising practiced by the controller does not meet the requirements of the Unfair Competition Act. With the appeal, the controller is pursuing its request further claiming that it can rely on Article 6(1)(f) GDPR as the legal basis for its data collection and processing. = The court held, that the controller's conduct violated the GDPR because the controller processed personal data of the dentists concerned without their consent. The court held, that contrary to the opinion of the lower court Article 95 GDPR does not render Article 6(1)(f) GDPR inapplicable in this case, because [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] does not constitute a provision in relation to which the GDPR imposes "additional obligations" on natural or legal persons. The court found that rather Article 13(3) of the e-privacy directive contains stricter requirements with regard to unsolicited direct marketing communications than the GDPR. Therefore, the court held that Article 6(1)(f) GDPR and [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] are, in principle, applicable concurrently. == However, the court held, that when assessing whether the data processing is carried out to safeguard a "legitimate interest", the assessments of [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] must be taken into account. The court found that the fundamental question of whether standards and valuations of national law may generally be applied when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR can remain open since the German legislator implemented [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML Article 13(3) of the e-privacy directive] with [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. It would, the court held, be in any event contrary to the principle of the unity of the Union legal order, if this implementation of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML rticle 13(3) of the e-privacy directive], which is applicable in accordance with Article 95 GDPR alongside the GDPR, had to be disregarded when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR. Additionally, the court considered, the CJEU had held that the coexistence of remedies under data protection law and competition law does not pose a threat to the uniform enforcement of the GDPR. == The court found, that the controller lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR because the purpose of its data processing violates [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG]. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG], a commercial practice that unreasonably harasses a market participant is impermissible. According to [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(1) UWG], this applies in particular to advertising, even though it is evident that the market participant addressed does not want this advertising. Following on from this, [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Section 7(2)(1) UWG] stipulates that unreasonable harassment is always to be presumed when advertising is carried out by telephone to a consumer without their prior express consent or to another market participant without their at least presumed consent. Presumed consent requires that, based on specific factual circumstances, the dentist can be presumed to have a justified interest in the telephone advertising. The court held that such an objectively justified interest of dentists in the sale of dental gold to the controller could not be established, because * an interest could not be inferred simply from the fact that the dentists called published their telephone numbers in publicly accessible directories, as this served solely to ensure accessibility for patients. * The sale of dental gold for profit is neither typical nor essential to the work of a dentist = The court held that the discretion generally granted to the DPA under the GDPR is limited in the present case to the extent that the DPA must intervene and impose a ban on the processing of the personal data of dental practice owners without their consent for the purpose of telephone advertising pursuant to Article 58(2)(f) GDPR. The court found that since the controller already lacked a legitimate interest within the meaning of Article 6(1)(f) GDPR, a design of the processing that complies with data protection law is not possible thus establishing an enforceable legal obligation for the controller to cease the processing is necessary.