Court case 11 ZB 22.895 – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a car dealer must keep records of test drivers to assist police investigations, even if it means storing personal data temporarily. This matters because it shows how businesses might need to balance privacy with legal obligations to support public safety.
What happened
The court decided that a car dealer must document test drives, including driver details, to aid police inquiries.
Who was affected
Individuals taking test drives at the car dealership were affected by the requirement to record their personal details.
What the authority found
The Higher Administrative Court of Bavaria ruled that the car dealer's obligation to document test drives is justified under GDPR's legitimate interest basis.
Why this matters
This ruling illustrates how businesses might need to retain certain data to fulfill legal duties, even when privacy concerns exist. It highlights the importance of understanding when legitimate interests can justify data processing.
GDPR Articles Cited
National Law Articles
The plaintiff owns a secondhand car dealership. One of the plaintiff's vehicles, driven by an unknown person, exceeded the permitted speed of 50 km/h. The police administration office sent the plaintiff a witness questionnaire and asked for the personal details of the responsible driver. The plaintiff stated that the person in the picture was not recognizable to him. The vehicle in question had been for sale and he had given it to persons unknown to him for test drives. He had always asked for a valid driver's license, which he only took a look at to make sure the person is allowed to drive. For reasons of protection of personal data, he did not store the data. The fine proceedings were then discontinued, but the authorities wanted to impose a requirement to keep a record of people driving cars that are registered in his name on the plaintiff. This can be imposed as an obligation under Article 31a StVZO - Road Traffic Licensing Regulations, if in the past a person who has more cars registered in his name, has failed to identify the driver of one of his cars. In the proceedings that followed, the plaintiff claimed that even if he did store the data for the period of the vehicle being driven by the other person, he would erase it pursuant to Article 17 GDPR after the drive. He argued that if it was not intended to buy the car, there was no actual legal basis under the GDPR to store such data. The Higher Administrative Court of Bavaria (VGH München) held that the plaintiff was required to document test drives and that this obligation was not contrary to Article 6(1) GDPR. Pursuant to Article 6(1)(f) GDPR, a controller may use the legal basis of legitimate interest even if those legitimate interests are pursued by a third party. Hence, the applicable legal basis for the plaintiff (the car dealer) was Article 6(1)(f) GDPR as the police, a third party, had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which include the pro
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 11 ZB 22.895 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 11 ZB 22.895 - Germany (2022). Retrieved from cookiefines.eu
Last updated: