Court case 13 O 129/21 – Court Ruling (Germany, 2022)

The controller is a credit reference agency. The data subject entered into a contract with a mobile phone provider under the address of his parents. The mobile phone was used by the data subject's brother. During the term of the contract, the mobile phone provider was unable to debit an amount due and, therefore, sent debt collection letters to the registered address. However, the data subject did no longer live at his parents' address. The debt was then settled in the short term, but the mobile phone provider terminated the contract and initiated a negative entry in the controller's debt register. One year later, the data subject requested the controller to delete the negative entry, because he has never received any which the controller refused. The controller felt it was entitled to keep the entry, because the debt has not been paid initially and two debt collection letters had been sent to the parents' address. Subsequently, the data subject obtained a judgement ordering the controller to delete the entry. The controller, however, did not immediately comply with the judgement. As it turned out, the data was still processed by the controller and shared with its customers. Only three months later, after the data subject again requested deletion, the controller finally removed the entry. The data subject then initiated new court proceedings claiming damages for the unlawful storage of its data. The controller applied for the dismissal of the claim, arguing that the negative entry was stored lawfully and the data subject did not suffer any damages. The incident partially occurred before the GDPR came into effect. The facts of the case were therefore partly assessed on the old version of the German Data Protection Act (BDSG a.F.). The Regional Court Hannover (Landgericht Hannover - LG Hannover) awarded €5000 in damages to the data subject according to Article 82 GDPR, since the the processing of the data by the controller violated the old German Data Protection Act and the new one. The court found that a credit reference agency may lawfully process data under the old and new version of the German Data Protection Act, if it proves that the data subject has received two debt collection letters by the creditor before the data is transferred from the creditor to the credit agency. However, the court determined that, in the case at hand, the defendant was not able to provide such proof, since the debt collection letters were sent to the parents' address and not the current address of the data subject. Moreover, the LG Hannover held that the claimant suffered non-material damages in the sense of Article 82(1) GDPR, because the controller unlawfully disclosed the data to its customers. The court also held that under Article 82 GDPR the violation does not need to amount to a grave violation, unlike usually required in German law for the compensation of non-material damages. Furthermore, the court came to the conclusion that the defendant was responsible for the event giving rise to the damages according to Article 82(3) GDPR. It held that initially the defendant was not obliged to verify whether the data subject received two debt collection letters by the mobile phone provider, but could rely on the mobile phone provider acting in accordance with the law. However, after the data subject had informed the controller that he has never received any debt collection letters, the controller was obliged to check whether this information was true. As it never did so, the court concluded that the controller was responsible for the damages which occurred after this time. When the LG Hannover determined the amount of damages, it took into consideration that the data was processed to calculate a credit score, which can significantly affect the professional and private life of a person, that the controller did not comply with its obligation to verify the lawfulness of the processing for two years and that the plaintiff himself contributed to the existence of the negative entries by not informing the mobile phone provider of the change of his address.