Court case 3 S 13/23 – Court Ruling (Germany, 2023)

A data subject bought a TV and a wall mount from an electronics shop (the controller) and, upon returning the wall mount, she received the price of the TV back, which was more expensive. After acknowledging the mistake, one employee tried to contact her autonomously using her private Facebook account via Facebook Messenger, which is not a common practice of the controller. After unsuccessfully asking the controller to provide her with information regarding the employees who contacted her, the data subject filed a first-instance application with the Local Court of Bühl (Amtsgericht Bühl - AG Bühl). Among others, the data subject sought an injunction to obtain information on which employees (name and surname) of the controller had been given access to her personal data and to prohibit those employees to further use her personal data. The AG Bühl held that employees cannot be seen as ‘recepients’ according to Article 15 GDPR, and thus the data subject does not have a right to obtain from the controller information about their identity. The AG Bühl thus dismissed the action and the data subject appealed the decision to the LG Baden-Baden. The LG Baden-Baden, making reference to the CJEU Judgment in CJEU - C-579/21 - Pankki S, acknowledged that employees of a data controller cannot, in principle, be regarded as recipients under Article 4(9) GDPR. However, this only applies when employees process data under the supervision and following instructions of the employer. In the case at hand, the employee acted in her private capacity, thus outside the supervision of the employer and contravening its instructions. For this reason, the LG Baden-Baden held that the employee who privately contacted the data subject should be seen as a ‘recepient’ under Article 4(9) GDPR. Therefore, the data subject has a right to obtain from the controller information about the recipient (i.e. the employee’s name and surname) according to Article 15(1)(c), in particular, insofar as this informa