Court case 3 S 50/21 – Court Ruling (Germany, 2021)

Controller is a private landlord, the data subject is their tenant. During an eviction dispute, the data subject filed an access request pursuant to Article 15 GDPR. The controller, however, rejected to comply with the request because it did not store any personal data as a private landlord. Hence, in their opinion, the GDPR did not apply. The data subject was of the opinion that the controller did process data, since their mobile phone number was used for the purpose of communication. Moreover, the controller commissioned an external company to prepare the utility bill. [https://www.lareda.hessenrecht.hessen.de/bshe/document/LARE210000903 The District Court of Wiesbaden acknowledged the data subject’s claim]. It held that the data subject’s personal data was clearly processed, and that none of the exceptions of Article 2(2) GDPR applied. Hence, it concluded the landlord violated Article 15 GDPR. The landlord filed appeal against this decision. The Regional Court of Wiesbaden rejected the appeal. It stated that the controller does process personal data. It noted that the personal data from the rental agreement is processed further by the external company in preparation for the utility bill. According to the Court, at that moment, "computer-aided processing takes place", which results in the company being a processor in accordance with Article 4(8) GDPR and Article 28 GDPR. Moreover, the Court notes that the controller processed data subject's personal data because they communicated via WhatsApp. Lastly, the Court stated that it is obvious that there is no abuse of the right to access, since the data subject's access request, and decided that the controller had to comply with the access request pursuant to Article 15 GDPR.