jameda GmbH – Court Ruling (Germany, 2022)

The controller is a private company, running a compare-and-review website for healthcare practitioners. The data subject is a dentist, whose personal data (name, academic title, field of practice, address, and telephone number of the office) was published through an online profile of her on the controller's website. The data subject did not consent to this data processing. Pursuant to Article 17(1)(d) GDPR, the data subject requested that the profile on the website of the controller should be deleted. The controller did not comply with the request. Consequently, the data subject brought the case to court. The courts of first and second instances held that, in view of the current design of the rating portal, the data subject was neither entitled to the deletion of the profile nor to an injunction against the publication of such a profile. There was no unlawful data processing by the controller since the weighting of the conflicting interests required by Article 6(1)(f) GDPR was in favour of the controller. The data subject decided to appeal the case again on the same grounds. This time to the German Federal Court of Justice (Bundesgerichtshof - BGH). The German Federal Court of Justice confirmed the decision of the previous courts. It held that the data processing was lawful upon Article 6(1)(f) GDPR since the interests of the data controller and the general public outweighed the interest of the data subject. By collecting, storing and passing on the ratings, the data controller provides the public using the portal with an insight into personal experiences and subjective assessments of patients of the respective practitioner, which readers can take into account in their own choice. Moreover, the controller's business model was supported by the right to conduct a business pursuant to Article 16 CFR. Additionally, pursuant to Article 11 CFR, the general public has a right and interest to freely express their opinions. The court also held that the rating of practi