The Federal Office of Economics and Export Control – Court Ruling (Germany, 2022)

The data subject is engaged in the dealing of firearms which are subject to a prohibition with a reservation of permission. Moreover, as became known in a separate court decision, the data subject is afraid of becoming a victim of kidnapping or robbery. The Federal Office of Economics and Export Control, the data controller, is the supervisory authority of the data subject in regards to the German laws on war weapons and has largely switched to electronic legal transactions via its communication portal: the electronic war weapons register. The data subject contacted the controller and complained that future information on the electronic war weapons register should only be transmitted by e-mail which is encrypted by a special software and objected to the current form of transmission as a precautionary measure under Article 21 GDPR and requested a restriction of processing under Article 18 GDPR. Additionally, the data subject complained about the controller's email communication, pointed out that the messages contained personal data within the meaning of Article 4(1) GDPR, and requested appropriate technical and organisational measures in accordance with the state of the art, such as end-to-end encryption, as well as the restriction of the processing pursuant to Article 18(1)(d) GDPR. The controller promised to carry out an examination but continued to use email to communicate with the data subject. The data subject took this as an occasion to apply for an exemption from the legally obligatory electronic notification of his weapon dealings. Eventually, his application was rejected and he was asked to continue using the controller's online portal for future notifications. As a response, the data subject brought an action for injunction before the Administrative Court of Frankfurt am Main concerning the controller's data transfers. The controller asked the court to reject the data subject's notion, reasoning that the data processing was justified by Article 6(1)(e) GDPR. Moreover, the GDPR would not contain a basis for the claim for the injunction sought by the applicant. At most, a general claim for injunctive relief under public law could be considered. However, the transfer of data had been necessary for the performance of the tasks of the public bodies to which the data had been transferred. The court rejected the data subject's action for injunction. It ruled that there is no infringement of rights due to an unlawful impairment of the legal positions of the applicant for a claim for injunctive relief under public law. There is a necessary legal basis for the processing of personal data and the processing, as to its legality and constitutionality, is not subject to any serious doubts by the court. The German EGovernment-Law, which purposefully expands electronic communication and also is the basis for the electronic war weapons register, is a democratically legitimised decision that does not conflict with the GDPR. With regard to the data subject's demand for higher encryption, the court has already stated in one of its decisions (15 July 2022 - 5 L 1281/22.F) that, in the case of electronic communication in connection with the notification of war weapon stocks to the Federal Office of Economics and Export Control, end-to-end encryption is currently sufficient. A higher level encryption is not necessary. Moreover, insofar as the data subject is particularly concerned with e-mail correspondence, the security standard of transport encryption demonstrated in the proceedings also satisfies the standards for the area of the electronic war weapons register.