Court case 28 O 168/22 – Court Ruling (Germany, 2022)

The controller is an operator of a search engine. If a user used specific keywords in a name-based search, the search engine showed search results that contained the following wording: "T ENTREPRENEUR, CMO AND VICTIM OF DOMESTIC VIOLENCE BY I, BOYFRIEND AND INVESTOR IN HER COMPANY I come from a privileged background, a loving family, I have a higher college degree, I’ve been an entrepreneur for as long as I can remember, I’m a CMO, I speak 5 languages fluently… and I was in an abusive relationship with a venture capitalist. The emotional abuse escalated into physical abuse and on the 23rd of April 2021 I ended up in hospital and he was incarcerated.” Images of the data subject were also included. The data subject requested an interim injunction stopping the search engine from listing search results containing the quote and his images. The Regional Court of Cologne (LG Köln) held that the application for an interim injunction is admissible and well-founded. The proceedings were brought against the controller on the basis of Article 79(2) GDPR. On the merits, the court ruled that the operator of a search engine is considered to be the controller within the meaning of Article 4(7) GDPR and that the controller is requested to delete the data subject’s personal data as the requirements of Article 17(1)(c) GDPR and Article 17(1)(d) GDPR are met. The processing of the data subject’s personal data in this case is not necessary for exercising the right of freedom of expression and information under Article 17(3)(a) GDPR. In particular, the rights of the data subject under Articles 7 and 8 of the Charter of Fundamental Rights of the EU (CFR) were in this case held to outweigh the freedom of the controller to conduct a business under Article 16 CFR and the freedom of expression and information under Article 11 CFR. In conducting the balancing exercise, it was decisive for the court that the data subject made it credible that the cited statements were untrue or opinions with an untrue factual core and that the data subject has still not been legally convicted for the alleged assaults. Therefore, the interests of the data subject were held to outweigh the interests of the controller.