Jameda – Court Ruling (Germany, 2022)

The controller operates a doctor search and rating platform under www.jameda.de. It posts the basic data of physicians as well as a grey silhouette as a profile picture with the notice "Only jameda customers can post a profile picture" on the portal without their consent. Users can submit ratings in the form of grades and free text comments. The controller offers doctors a paid "premium package" with which they can add a photo and additional information to their profile and with which the defendant contributes to better findability on Google. In early 2018, the data subject who is an eye specialist learned that a negative review had been posted about her on the controller's website. She was rated there as "arrogant, unfriendly, unprofessional". The data subject asked for this evaluation to be deleted and for the author to be informed. The controller refused, as well as to the deletion of the data subject's basic data. In her lawsuit, the data subject demanded the deletion of her basic data from the controller's portal. While that was successful in the first instance, the Higher Regional Court dismissed the action on appeal by the controller. The German Federal Court of Justice (Bundesgerichtshof - BGH) dismissed the data subject's appeal. The court found that the requirements of the right to erasure pursuant to Article 17(1) GDPR were not fulfilled. First, the processing was not unlawful pursuant to Article 17(1)(d) GDPR. As the processing was based on Article 6(1)(f) GDPR, the legitimate interests and fundamental rights of the data subject did not outweigh the interests of the controller. On the data subject's side, the court weighed her right to the protection of her personal data pursuant to Article 8 CFR, the not inconsiderable risks to her claim to social and professional standing (Article 7 CFR) as well as the economic success of her self-employed activity (Article 16 CFR). The court considered that the evaluations could directly affect competition with other doctors and, in the case of negative evaluations, even jeopardise the professional existence of the person evaluated. The broad impact of the controller's rating portal and the possibility of abuse by false or insulting ratings was also considered. On the other side, according to the court, the controller exercised both its own legitimate interests and the legitimate interests of the users of its platform by processing the personal data of the data subject on the platform: it acted both pursuant to its freedom to conduct a business (Article 16 CFR) and to the users' right to freedom of information (Article 11 CFR). The court emphasised the considerable interest that the public has in the information and possibilities offered on the controller's portal which can contribute to providing patients with the information they need when exercising their choice of doctor. It could fulfil this purpose only to a limited extent if it were dependent on the consent of the rated doctors, which could be withdrawn - for example in the case of a weaker rating. The court concluded that a self-employed person must be prepared for observation of their conduct by the wider public because of the effects their activity has on others, and for criticism of their performance. Furthermore, the data subject is not defenceless. She can counter untrue factual claims and insulting or otherwise inadmissible evaluations by contacting the controller and demanding the removal of the content. Second, the court held that the requirements of Article 17(1)(c) GDPR were also not fulfilled since there were overriding legitimate reasons within the meaning of Article 17(1)(c) GDPR for the processing of the data subject's personal data. The overall weighing that is also required in this respect did not lead to a different result than the weighing carried out under Article 6(1)(f) GDPR.