Court case 1 K 6024/20 – Court Ruling (Germany, 2023)

The data subject held a property insurance policy with a controller, insuring against storm damage. The Controller is member of the Association of the German Insurance Industry and reports to the Insurance Industry's Reference and Information System. On 15 March 2019, the data subject submitted eight photos claiming storm damage to his property and the controller compensated the €2,840 claimed damage. Subsequently, on 17 December 2019, 3 February 2020, and 1 March 2020, the data subject filed additional claims using the same photos. The controller refused payment for these claims and subsequently canceled the insurance policy and reported the data subject to the informa HIS GmbH, operator of the Insurance Industry's Reference and Information System, indicating "anomalies in the claim process." The data subject filed a complaint with the DE-HE DPA, which transferred it to the DE-BW DPA as lead authority for the customers insurance. The DE-BW DPA ordered the controller to delete the entry in the Insurance Industry's Reference and Information System, arguing the controller lacked legitimate interest under Article 6 GDPR#1f. The VG Stuttgart overturned the DE-BW DPA's decision, stating that the controller had a legitimate interest under Article 6 GDPR#1f to report the anomalies to the Insurance Industry's Reference and Information System. The court emphasized that the legitimate interest does not require an actual fraud attempt, only that fraud-related anomalies exist according to Insurance Industry's Reference and Information System's guidelines. The court held that the data subject's insurance company was entitled to assess and manage risks based on potential fraudulent behavior. The repeated use of identical photos for separate claims indicated a significant probability of fraud, justifying the controller’s actions. Further, the data subject's rights did not outweigh the insurance company's legitimate interests. First, the court held that the controller’s processin