Court case 5 O 457/20 – Court Ruling (Germany, 2021)

The controller is a credit reference agency. The data subject is a private person over whose assets, insolvency proceedings were opened. In the course of the insolvency proceedings the data subject was granted a discharge of residual debt, which the controller added to the data subject’s credit report as a negative entry. The data subject unsuccessfully requested the controller to remove the entry and the subsequent applications for an injunction were rejected for lack of merit at trial. The data subject argued that the negative entry was to his detriment as it restricted his ability to participate in economic life. In particular, he could not obtain overdrafts, finance property or car, or place internet orders on account. He argued that the processing of the data on the discharge of residual debt by the controller was unlawful. The data subject requested, inter alia, to order the controller to remove the entry. The controller instead justified the processing with the necessity to provide its contract partners with facts to assess the data subject's creditworthiness. Deleting the entry would deceive potential lenders and possibly induce them to grant a loan without having sufficient information on the data subject's actual creditworthiness. The court had to decide whether the data subject was entitled to have the negative entry deleted and whether the data subject was entitled to injunctive relief against the controller’s data processing in connection with the discharge of residual debt. The appellate court dismissed the claim. It held that the requirements for a claim for erasure pursuant to Article 17(1) GDPR were not met, and the processing is lawful pursuant to Article 6(1)(f) GDPR. Pursuant to Article 17(1), data subjects have the right to demand from the controller that their personal data be deleted without undue delay, provided that one of the grounds specified in the provision, applies. This is in particular the case if there are no overriding legitimate grounds for the processing, the purpose of processing no longer exists or the processing of personal data was unlawful. The court pointed out that, according to the [https://research.wolterskluwer-online.de/document/77de5b4c-8fd7-4e9a-97f6-329f1b45e41f German Federal Court of Justice], a legitimate interest exists if credit lenders transfer the management of their interests to credit reference agencies for reasons of security and rationalisation. Criteria for the risk-free approval of credit applications also include information on insolvency proceedings and their outcomes. Thus, the notification of the granting of a residual debt discharge is in the interest of the controller. Granting a residual debt discharge does not aim at enabling debtors to participate in economic life as if insolvency proceedings had not existed at all. The data subject cannot demand to be put on an equal footing with a person who was never affected by insolvency. Such interests are not protected and therefore cannot outweigh the interest of future business partners in checking the creditworthiness of their debtors. In conclusion, the data subject had no overriding legitimate interest in the removal of the entry. The processing of the residual debt discharge entry by the controller is lawful. Thus, a claim for deletion under Article 17(1)(d) GDPR has no merits. Moreover, the Court held that the negative entry is stored by the controller in order to provide its contract partners with information about it. This purpose persists and could not be pursued without the entry. A claim for deletion pursuant to Article 17(1)(a) GDPR has no merits either. Lastly, a claim for deletion also does not follow from Article 17(1)(c) GDPR. The data subject has neither objected nor is the data subject's particular personal situation apparent.