Federal State of Bavaria – Court Ruling (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court in Bavaria ruled that a lawyer did not break privacy rules by submitting unmasked personal data in a lawsuit over legal fees. The court found that the lawyer had a legitimate reason to use the data to support his claim. This decision highlights the balance between privacy and the need for evidence in legal proceedings.
What happened
A lawyer submitted unmasked personal data in a court case to support a fee claim.
Who was affected
The person involved in a legal dispute with their former lawyer over fees.
What the authority found
The court decided that the lawyer's use of personal data was necessary for pursuing a legitimate interest, thus not violating data protection rules.
Why this matters
This case shows that courts may allow unmasked personal data in legal cases if it's necessary for a legitimate interest, like proving a claim. Lawyers and businesses should understand when privacy rules allow using personal data in legal contexts.
GDPR Articles Cited
The data subject is in a dispute with their former lawyer about the lawyer's fee claim. The attorney represented the data subject in proceedings concerning a traffic accident but terminated the mandate. A lawsuit over the lawyer's fee claim ensued. To proof his claim, the lawyer submitted the correspondence with the data subject to the court. The correspondence contained personal data such as car plate number, names, attending doctor, and the data subjects injuries from the traffic accident. The data subject takes the view that the personal data should have been masked before the documents were submitted to the court. In a letter to the lawyer, dated March 2016, the data subject complained about a breach of secrecy. The Bavarian Data Protection Authority (DPA) received a complaint from data subject in January 2019. In May 2019 the DPA replied that it considered the course of action by the lawyer not an infringement of data protection guidelines. Masking of personal data was therefore not necessary. The data transfer was a data processing under Article 4(2) GDPR. Legal basis was Article 6(1)(f) GDPR and the data processing was necessary to pursue a legitimate interest. The pursuit of a fee claim is considered such a legitimate interest. Article 9(1) GDPR specified that health data, such as injuries from an accident, are special categories of data. The DPA holds, that the requirement in Article 9(2)(f) GDPR for processing special categories, was fulfilled. The processing was necessary to exercise a legal claim. While masking of the personal data was technically possible, the data processing (without masking) was necessary to reinforce the fee claim with authentic evidence. Generally, it must be possible to submit unaltered evidence in a law suit. Otherwise any evidence would bear the risk of potential data law infringement. Courts and attorneys are subject to the professional duty of confidentiality, which the DPA considered a sufficient data protection measure for
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Federal State of Bavaria in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Federal State of Bavaria - Germany (2021). Retrieved from cookiefines.eu
Last updated: