Court case 24 O 1624/23 – Court Ruling (Germany, 2024)

The data subject signed a contract with the controller for telecommunications services. On 26 June 2023, the data subject received information about a data transmission. The data subject objected to the disclosure by the controller of his personal data included in a contract to a legal entity other than the parties to the contract. The controller registered contract data to a legal entity other than the parties to the contract, supporting a joint fraud control system for the credit industry. The controller shared the personal data (name, address, date of birth, dates of the start and end of a telecommunications contract, contract number and reporting feature) without explicit consent of the data subject. The data subject initiated legal proceedings and was seeking damages, in the form of non-material compensation, for a data transmission without consent. The Regional Court Memmingen dismissed the case on the grounds that the data subject had failed to prove the existence of any present or future damage that was reasonably likely to occur. The prevention of fraud may constitute a legitimate interest of the controller within the meaning of Article 6(1)(f) GDPR.