www.jameda.de – Court Ruling (Germany, 2022)

The controller managed a website – www.jameda.de – where personal data of doctors’ where collected and made available to internet users. These data included at least: name, academic degree and specialization of the practitioners, as well as professional addresses and telephone numbers. Data were processed without data subjects’ consent. The controller also offered doctors the option to add further information to their basic profile by paying a price. This optional service included the possibility to upload pictures, statements, articles, videos etc. Both basic and “premium” profiles enabled users to anonymously publish their “reviews”, which were attached to the doctor’s profile and publicly visible. The data subject was a doctor reviewed on the website, but they never consented to the processing of their personal data by the controller. He brought several allegations against the controller and requested a civil court to order the controller to erase the profile and stop several processing operations. The Regional Court of Munich (Landgericht München – LG München) declared the processing unlawful and imposed on the controller the erasure of the profile insofar as personal data of the data subject were associated with user reviews. However, the data subject appealed the part of this judgement that was not favourable to them. In particular, the data subject asked the court of appeal to check whether the controller violated the GDPR by implementing for premium profiles a design that infringed the data subject’s fundamental rights. More specifically, in the data subject’s view, services offered to paying customers indirectly put the data subject in a position of disadvantage, as basic profile holders were not allowed to personalise their page. In addition, the appeal concerned the fact that the data subject’s basic profile was used to display advertisements regarding other doctors who decided to subscribe to the “premium” option, again damaging the data subject’s professional activity. The controller also appealed. The Higher Regional Court of Munich (Oberlandesgericht München - OLG München) found that data processing, based on a legitimate interest of the controller, was outweighed by the fundamental right to data protection of the data subject. In particular, processing was unlawful insofar as the controller granted a more favorable treatment to paying customers, enabling them to personalize their profile, whereas the data subject could not. However, the Court of Appeal dismissed the argument that the controller should refrain from displaying third-party advertisements on the data subject’s personal profile, as there was no real competition between the data subject and other doctors. As a matter of fact, doctors involved had different specialisations. Both the controller and the data subject appealed to the German Federal Court of Justice (Bundesgerichtshof – BGH). The Federal Court of Justice clarified that processing in the case at issue could be solely based on legitimate interest pursuant to Article 6(1)(f) GDPR. The existence of a legitimate interest depends on 3 elements. The first element is the legitimate interest itself, namely an interest that is rooted in the law or in a societal need. Concerning this first element, the Federal Court of Justice held that the portal managed by the controller pursued both a controller’s interest and a general interest of the users of the platform. On the one hand, the collection of data about medical practitioners could be seen as a manifestation of the freedom of information under Article 11 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A12012P%2FTXT Charter of Fundamental Rights of the EU], both in its active and in its passive dimension. As a matter of fact, the function of the website not only did not conflict with the legal system but was also socially desirable: thanks to this service, patients could better choose their doctor. The users’ right to disseminate opinions is also a fundamental one. On the other hand, running the platform was also part of the controller’s fundamental right to conduct a business, which is enshrined in Article 16 of the Charter of Fundamental Rights of the EU. As a second step, the Federal Court of Justice assessed whether the processing was really necessary to achieve the legitimate interest. The judges found that processing was indeed necessary to provide users with an overview of medical profession, insofar as processing was limited to the name of the doctor, their academic degree, professional information and the ratings by patients. Thirdly and finally, a legitimate interest should not be outweighed by data subjects’ rights. The Federal Court of Justice pointed out to the fact that in the present case, not only data protection, but also data subjects’ right for private and family life (Article 7 of the Charter of Fundamental Rights of the EU) and their right to conduct a business might be impaired. However, the legitimate interest of controller and users prevailed. Preliminary, the court stressed that doctors shall accept the risk of receiving bad reviews by customers. Moreover, in the opinion of the Court, the possibility of using legitimate interest as a valid legal basis ultimately relied on the fact that the controller did not violate its duty of neutrality by unfairly favouring paying customers. In this sense, the mere fact that premium account holders had a privileged position was not sufficient in itself to break neutrality obligations. What is relevant, according to the Federal Court of Justice, is that the controller did not put pressure on the data subject by displaying on their personal page advertisements from potential competitors. This did not occur in the present case as advertisements popping up on the data subject’s profile concerned doctors whose field of specialisation was not related to the one of the data subject. Furthermore, the simple difference in the design of basic profiles and premium profiles did not entail unfair advertising operations on behalf of paying customers. According to the Federal Court of Justice, it was clear to the average user that a difference in the layout of the profiles did not depend on the doctor’s skills, but rather on their willingness to personalise their profile on the platform. For this reason, the judges considered very unlikely the occurrence that a user, comparing basic and premium profiles, could switch to a doctor holding the latter because of the profile design alone. In light of the above, the Federal Court of Justice dismissed the data subject’s appeal and upheld the controller’s one.