Court case 27 O 60/24 – Court Ruling (Germany, 2024)

The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Subsequently, the controller transferred the name, the date of birth, the address, and information about the conclusion of the contract to Schufa. Following his request, Schufa informed the data subject about the data forwarded by the controller. In a [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages. The court recognised the controller’s interest in lowering its financial risk. If the controller enters into a contract in which it periodically charges the client for its services without a pre-paid system, there is a certain risk of the client not paying for services made in advance. This risk increases when the client is handed a mobile phone at the beginning of the long term contract. Therefore, a risk of being defrauded exists for the controller. The court further recognises the possible advantage of a standardised notification about the contract conclusion to Schufa. In cases where a (potential) client enters several mobile phone contracts by using their real name without a sensible reason, this can thus be noticed. However, concerning the standardised transfer of data to Schufa without any specific suspicion the court concludes that in the balancing test necessary under Article 6(1)(f) GDPR the data subject’s interest override the interest of the controller. This is due to the fact that a client typically doesn’t expect this kind of data transfer. Especially, customers can expect being asked for their explicit consent prior to such a transfer. If the controller insists to transmit data to Schufa it can condition the closure of a contract on the data subject’s consent to the data transfer. Due to this possibility, the automated transfer of data to Schufa goes beyond the strictly necessary criterion referred to in Recital 47. If the controller does not ask for consent upon closure of the contract it might still transmit data to Schufa if circumstances appear that make it likely that the customer has provided misleading information, especially about their creditworthiness, or if specific risk factors occur. Therefore, the controller unlawfully submitted the data subject's personal data to Schufa. This constituted an infringement in terms of Article 82(1) GDPR. However, the court held that there is no damage and rejected the respective claim. The burden of proof lies with the data subject even though there is no specific threshold of severity that needs to be met. The data subject failed to prove a non-material damage. On the one hand, the data subject did not confirm in the oral hearing the previously claimed constant fear of uncomfortable further inquiries, a general uncomfortable feeling, and a feeling of powerlessness. The court therefore considers the previous written statement a text module. On the other hand, the court believed the data subject that he was angry about the data transfer. This, however, did not amount to a non-material damage. The court does not believe the claim made by the data subject that he has trouble sleeping at night due to the data transfer.