Court case 11 ZB 19.991 – Court Ruling (Germany, 2020)

In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out). According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.