Court case 16 K 16155/21 – Court Ruling (Germany, 2021)

Controller is a tax office. Data subject is an individual whose income from self-employment was audited. Data subject found that their personal data was processed unlawfully, and requested the Financial Court Berlin-Brandenburg to order the controller to pay (effective punitive) damages pursuant to Article 82 GDPR. The chairman on the Court informed the parties on 21.04.2021 that the claim for damages possibly needed to be brought before the ordinary courts, rather than the financial courts, since this could be regarded a claim for official liability (Article 34 GG and Article 40(2) VwGO). Data subject found that Article 82 GDPR constitutes a separate basis for a claim, and found that the financial court was compatible to rule. The Court held the claim is inadmissible. The Court stated that a claim, pursuant to Article 82 GDPR, directed at state authorities, must be asserted in accordance with the procedural rules of the respective Member State for the enforcement of claims in the event of breaches of official duties, in Germany therefore before the ordinary courts (Article 34 GG, Article 40(2) VwGO). Moreover, the Court considered the reference to Article 79(2) GDPR from Article 82(6) GDPR, and the fact that one could argue that Article 82(6) GDPR overrides Member State procedural law. The Court, however, noted that Article 79(2) GDPR only regulates international jurisdiction. This means that this provision only regulates which courts of which state have jurisdiction in a claim for damages, and does not regulate which court within a Member State is compatible to handle such a claim. The Court claimed that this interpretation is supported by recital 145 because this recital only addresses cross-border situations, and the fact that the European Parliament and the Council of the European Union already have no regulatory competence for the procedural enforcement of claims within the Member States.