Court case 2-24 O 156/21 – Court Ruling (Germany, 2023)

The plaintiff in this case is a consumer protection organization under German law. The defendant is a German energy and gas provider, which, with a view to lowering the risk of payment defaults, is in a contractual relationship with SCHUFA Holding AG and another credit rating agency, hereinafter the credit agencies. This contract foresees that whenever an interested individual submits a request for conclusion of an energy provision contract on the online form of the defendant, the latter sends the basic information about the interested persons to the credit agencies, that calculate a credit score about them, and receives information on the economic risks related to those individuals. The plaintiff read the general terms and conditions on the webpage of the defendant and under “Data Protection, Creditworthiness information” – “Data Transmission to SCHUFA and other agency” which stated that the defendant transmits data collected in the request for conclusion, the implementation and termination of a contract and data about non-contractual behavior to the credit agencies, on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. The plaintiff considered that the transmission of so-called “positive data” on the implementation and termination of a contract to be unlawful and directed this in a letter to the defendant in December 2020, asking the plaintiff to cease using those clauses. In its view, the transmission of such data was not justified by any of the legal bases of Article 6(1) GDPR. The plaintiff first filed a lawsuit with the Regional Court of Darmstadt, which concluded that it was not competent to deal with the case and referred it to the Regional Court of Frankfurt am Main (Landgericht Frankfurt am Main, LG). The plaintiff asked the court to order the defendant to cease and desist from any further violations and to refrain from using the contested clauses in its terms and conditions in consumer contracts for energy supply. In its submissions, the defendant argued that the claim should be dismissed, already because the plaintiff was not authorized to bring an action before a court and because the claim was unfounded. Further, the defendant argued that the content of the terms constituted a mere privacy notice, whose content is not binding. First of all, the court held, against the view of the defendant, that the plaintiff did have standing before the court as a consumer protection organization under [https://www.gesetze-im-internet.de/uklag/ §3(1)(1) the German UklaG], to bring a claim under Article 80(1) GDPR and Article 80(2) GDPR. Also, the court clarified, making reference to CJEU case C-319/20, that Article 80(2) GDPR does not presuppose the existence of a concrete violation of a data protection right, but it is sufficient that the processing in question could violate the rights of identified or identifiable data subjects - in this case, all those who concluded an energy contract with the defendant after 2019 by accepting the contested terms. Also, the court held that it suffices for the personal scope of Article 80(2) GDPR to be open, that a violation of consumer protection law, in this case the terms and conditions of the defendant, goes hand in hand with a violation of the GDPR. Hence, the court considered that all the requirements of Article 80(1) GDPR and Article 80(2) GDPR were met. As regards the content of the terms, the court first considered that the clauses in question constituted a concretization of the object of the contract, as clarified in another clause of the terms, so that the average consumer understood such clauses as a privacy policy and not as a mere notice, as submitted by the defendant. The court went on to ascertain whether the content of the clauses constituted a disproportionate disadvantage for consumers under the German Civil Code (Bürgerliches Gesetzbuch, BGB), which is given when a party deviates from a norm, protecting a consumer, in a significant way. In this, the court assessed whether the defendant had deviated from the obligation under Article 6(1) GDPR in a significant way, that is, whether the transmission of “positive” data to the credit agencies by the defendant could be based on Article 6(1)(b) GDPR or on Article 6(1)(f) GDPR. After clarifying that data regarding the implementation and termination of a contract cannot be considered “negative” data, thus not credit-relevant data, the court considered that the transmission of such data cannot be based on Article 6(1)(b) GDPR. As a matter of fact, the court could not ascertain how the transmission of such data to credit ranking agency would be necessary for the performance of an already concluded contract between the energy provider and a consumer. Further, the court considered whether processing for other purposes could be based on Article 6(1)(f) GDPR. To this end, the transmission of positive data would have to be necessary for the protection of a legitimate interest of the controller or a third party, insofar as the rights and interests of the data subject do not override them. In the case at hand, the court held that it cannot be excluded a priori that positive data about a person might be used for credit scoring purposes. However, the court clarified that it is up to the credit agency to prove to what extent such data are necessary for credit scoring, as per [https://www.gesetze-im-internet.de/bdsg_2018/ § 31 BDSG]. In the case at hand, the court held that first, the defendant failed to clearly define which data about the implementation and termination of a contract would be transmitted and also failed to provide reasons for the transmission of such data which also suggests that they might not even be used for calculating a credit score; secondly, the court observed that in any case, the interests and rights of the data subjects prevail over those of the defendant. This occurs when, for instance, the data subject cannot expect further processing of his or her data, as suggested in Recital 47 GDPR. Effectively, not knowing exactly which data is transmitted constitutes a significant interference in the right to informational self-determination of individuals and leaves them confused as to whether their data are going to be further processed or not. Thus, the court considered the contested clauses in the general terms and conditions of the defendant to be in violation of Article 6(1)(f) GDPR and unreasonable under the BGB. The court thus ordered the defendant to cease and desist from using the clauses in its terms and conditions in the context of consumer contracts.