Court case 2 A 111/22 – Court Ruling (Germany, 2023)

A company’s (controller) activity was to buy metal residues from dental practices and laboratories. In this purpose, the controller was searching for contact details of practitioners and laboratories from publicly accessible directories such as the Yellow Pages. These data included surname and first name of the practice owner, address and phone number and were stored on the controller’s database. The controller then used these data to contact dentists and researchers to find out if they were selling metal residues. A dentist complained to the Saarland Administrative Court which ordered the controller to stop the processing of dental practices’ owners for advertising purpose without consent and to delete the data stored under a €2,500 penalty. The controller appealed this judgment with the Higher Saarland Administrative Court, requesting from the administrative Court to rescind the decision. The controller claimed that it had a legal basis for the processing. It explained that the purpose of the advertising was to make a profit, which is a legitimate interest within the meaning of Article 6(1)(f) GDPR. The processing must also be necessary for this purpose. The controller considered that it was “simply a question of whether an equally suitable but less intrusive means is available”. In this case, it held that a contact by telephone only lasts about one minute on average while postal mail would require additional administrative work on the part of the data subject. It concluded that contact by telephone was a milder option than contact through postal mail. The controller added that under the GDPR, data processing would only lack legal basis if the interests of the data subject outweighed the legitimate interest of the controller. An equal impact on the data protection interests of the data subject was therefore not sufficient. The Administrative Court requested to dismiss the appeal. It added that this kind of advertising had an anti-competitive nature. Accordin