Court case 5 Bs 152/20 – Court Ruling (Germany, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A YouTuber found and filmed patient files left in an abandoned hospital, leading to privacy complaints. The court ruled that the property company was not responsible for securing the files, as the DPA's order for 24-hour surveillance was deemed unnecessary. This case highlights the importance of proper data protection even after a business closes.
What happened
A YouTuber discovered unsecured patient files in an abandoned hospital, which led to privacy complaints.
Who was affected
Former patients of the hospital whose files were left unsecured in the building.
What the authority found
The court decided that the property company was not responsible for the files, as the DPA's order for constant surveillance was excessive.
Why this matters
This ruling emphasizes that businesses must ensure secure data storage even after operations cease. It also shows that DPAs must justify their enforcement measures, especially when they impose significant burdens.
GDPR Articles Cited
The applicant was a property company and a (former) sister company of a hospital operating company. The hospital operating company filed for insolvency in April 2010, and in October of the same year the hospital operations were discontinued. After the clinic ceased to operate, the patient files kept in paper form remained in two basement rooms originally intended to house the files. The hospital building subsequently stood empty and was temporarily looked after by different caretakers. In the end, a security service also carried out external checks on the building. On 10 May 2020, a Youtuber entered the former hospital building, including the two file rooms located in the basement, and came across the patient files that had been left behind. The video uploaded on the video platform "youtube" caused a broad media response as well as complaints from former patients under data protection law. The competent DPA tried to contact responsible persons of the applicant or clinic for clarification and to establish remedial measures, but these attempts have essentially remained fruitless. In the meantime, the local public authorities, in consultation with the DPA, undertook measures to secure the building and, in particular, to prevent unauthorised persons from accessing the file rooms. After further attempts of unauthorised entry by third parties had occurred, the regulatory authorities, following a corresponding request for administrative assistance by the supervisory authority, commissioned a 24-hour surveillance by a private security service. Finally, in June 2020, the DPA issued a decision based on Article 58(2)(d) GDPR. The property company filed an application for interim relief against this order. By decision of 30 July 2020, the Administrative Court granted the application and restored the suspensive effect of the applicant's action. The appeal of the defendant (DPA) is directed against the above Court's decision. Was the mere storage of the files in the clinic b
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 5 Bs 152/20 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 5 Bs 152/20 - Germany (2020). Retrieved from cookiefines.eu
Last updated: