VG Mainz – Court Ruling (Germany, 2023)

The controller was a company that allowed their employees to use the company vehicle. One of these cars was used to commit traffic offences. During the police investigation, it was not established which employee had driven the car at that time. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law. The controller refused to comply with the order and appealed it before a court. The controller argued that the GDPR precludes the disclosure of personal data of the driver(s) to the authorities and the keeping of a logbook with the drivers' names. The first instance court rejected the claim and the controller appealed the decision before the Higher Administrative Court of Rhineland-Palatinate (Oberverwaltungsgericht Rheinland-Pfalz, OVG Rheinland-Pfalz). The court of appeal upheld the first instance judgement. According to the court, both the disclosure of personal data of the drivers and the keeping of a log with personal data of the latter were permissable pursuant to Article 6(1)(f) GDPR. As a legal basis, the controller could (and should) rely on the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. Moreover, the court observed how the further stages of the processing were also permissable from the public authority side under Article 6(1)(e) GDPR.