Court case 4 K 1338/21 – Court Ruling (Germany, 2022)

The controller published a screenshot of an advisory board video call meeting on his webpage, where among others, a local politician, the data subject, could be seen. As a response, the data subject filed a complaint to a DPAWhich exact DPA was concerned was not further specified in the decision. which, subsequently, issued a decision on the matter. In the decision, the DPA stated that the publication of the screenshots and videos violated the personality right of the data subject. Even a possible justification pursuant to Article 6(1)(f) GDPR due to the fact that (1) the data subject is a public figure and (2) it would be in the public interest to know what he is doing, would not prevail over the data subjects interest to not be defamed. Information about the his work is available in the protocol of the meeting, which is available to the public. The general public could get a better picture of the work from the protocol than from a screenshot, which does not provide any context, except the visual appearance of the data subject. Therefore, there was no need to process the data by publishing it in a visual form on a website. The main purpose of the publication of the screenshot was to defame the data subject, not to inform the general public about his work. The decision ordered the controller to erase all personal data and prohibited the future recording of videos or screenshots of the advisory board meetings. Subsequently, the controller filed a lawsuit against the DPA's decision at the Administrative Court in Bremen. In its decision, the court held that the decision from the DPA was legally correct and dismissed the case. The publication of the screenshots and videos on a private webpage, which is mostly used by the data controller to express his views and not to inform the general public about current affairs, constituted a processing of personal data in the sense of Article 4(2) GDPR. Therefore, the data controller needed a lawful ground for processing in the sense of Article 6(1) GDPR. Due to the fact that the purpose of the processing was not in the interest of the general public, where the interest of the public would prevail over the interest of the data subject, but predominantly served to defame the data subject, the legal ground of Article 6(1)(f) GDPR could not be considered. Also, there was also no need for the publication of the videos and screenshots. There were other (official) means to inform the public. The general public could watch the meeting live via web stream, protocols were published afterward. The erasure of the videos was justified as an act of the DPA under Article 58(2)(f) GDPR. The court also confirmed the decision of the DPA to refrain from any future publications.