Court case 1 O 64/24 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a telecommunications company could share a customer's data with a credit rating agency without consent. This is significant because it clarifies that companies can share data for legitimate business interests, but it also raises concerns about privacy. Businesses should ensure they have a valid reason for sharing personal data.
What happened
A telecommunications company disclosed a customer's personal data to a credit rating agency without the customer's consent.
Who was affected
The customer whose data was shared without consent.
What the authority found
The court found that the data sharing was necessary for the legitimate interests of the company, thus permissible under data protection rules.
Why this matters
This ruling illustrates the balance between business interests and privacy rights. Companies must be transparent about data sharing and ensure they have a valid reason to do so.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject entered into a telecommunications contract with the controller who then informed a credit rating agency about the establishment of the contract and disclosed personal data in connection with the contract. The data subject claimed that he never consented to the transmission of the data. He elaborated that the controller acted unlawfully as the transmission of the data was not necessary for the performance of the contract nor justified through legitimate interest under Article 6(1)(f) GDPR. In addition, the data subject claimed appropriate damages as he believed that the transmission of data negatively affected his credit score which caused him persistent existential worries. The controller argued that the transmission of data is necessary for fraud prevention, prevention of overindebtedness and for the precise prognosis of risk of default. Further, it stated that the transmission in question was indicated to the data subject when entering into the contract and rejected the argument that the data transmitted affected the credit score of the data subject. Before the claim was filed by the data subject, the credit rating agency had already deleted the data indicating whether a telecommunications contract had been entered into. The regional court of Passau (Landesgericht Passau – LG Passau) held that the data transmission was permissible under Article 6(1)(f) GDPR as it was necessary for the legitimate interests of the controller and third parties. The transmission of data was held to be necessary for fraud prevention as it allows for more precise prognosis on overindebtedness and risk of default. Moreover, due to the narrow scope of the transmitted data the court found that the fundamental rights or freedoms of the data subject did not outweigh the controller’s interests. The court further rejected the data subject’s claim to damages under Article 82(1) GDPR. It found the argument that precisely this transmission of data negatively affected the d
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 1 O 64/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 1 O 64/24 - Germany (2024). Retrieved from cookiefines.eu
Last updated: