Court case 13 O 220/23 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject faile
GDPR Articles Cited
National Law Articles
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject faile
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 13 O 220/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 13 O 220/23 - Germany (2024). Retrieved from cookiefines.eu
Last updated: