Court case 38 O 243/23 – Court Ruling (Germany, 2026)

A telecommunications company is the controller. In 2023, the controller carried out a large scale direct marketing campaign directed at data subjects who were customers of other telecommunication providers. The letters included a “contract summary“, with a price offer and cancellation policy. The marketing was directed at data subjects personally, with the controller including their name, address, and landline number. The controller obtained this data from a mailing list vendor without the data subjects’ consent. In September 2023, a qualified entity issued a cease and desist notice to the controller, due to data protection, competition, and consumer law violations. The qualified entity also requested information from the controller regarding its data processing activities and sources of data. The qualified entity later brought an injunction claim against the controller. Regarding the GDPR violations, the qualified entity requested the court to order the controller to refrain from processing data subjects’ address and contact information through direct marketing campaigns without their consent, as well as order the controller to fulfill its information obligations in accordance with Articles 14(1) and 15 GDPR. Finally, the qualified entity requested the court to order the controller to them a total of €243.51. The controller requested the court to dismiss all claims. The controller argued that its data processing activities were lawful under legitimate interests (Article 6(1)(f) GDPR). In addition, direct marketing activities always constitute a legitimate interest under Recital 47 GDPR. The court found that the controller had violated national competition and consumer laws in the direct marketing campaign, as it considered it an unfair commercial practice. The court found a violation of Articles 5(1)(a) and 6(1) GDPR). According to the court, the controller processed data subjects’ address and contact information without a legal basis in writing and sending the promotional letters. The court stated that the controller could not rely on Article 6(1)(a) GDPR, as the data subject had not consented to the processing. In addition, the controller could not rely on legitimate interests under Article 6(1)(f) GDPR. The court first stated that Recital 47 GDPR simply indicated that direct marketing was a possible legitimate interest. Furthermore, the fact that direct marketing serves a legitimate interest purpose does not make the processing lawful. The court found that the processing did not meet the three cumulative conditions as established by the CJEU.see ECJ, Judgment of July 4, 2023 – C-252/21, Meta Platforms Inc. et al. v. Bundeskartellamt para. 106 This is because the controller failed to fulfill its other obligations under the GDPR. The court also emphasised that lawfulness of the direct marketing campaign cannot depend on the data subject’s lack of objection. The court found a violation of the controller’s information obligations. The court stated that the controller failed to provide the data subject with information related to the sources of its data, as well as the data subject’s right to object (Article 21 GDPR). Therefore, the controller violated Articles 14(1), (2)(a)-(c), (e) and (f) GDPR, as well as Articles 12(1) and (5) GDPR. In addition, the controller failed to provide information required by Articles 12(3) and 15 GDPR following the access request by the qualified entity. The court noted that the controller failed to provide the information, as well as an explanation on why the one month deadline was not complied with. The court ordered the controller to refrain from processing data subject’s data in the context of direct marketing campaigns without consent. In addition, the court ordered the controller to comply with its information obligations, and pay the qualified entity €243.51,