Court case 13 O 220/23 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a telecommunications company shared a customer's personal data with a credit agency without getting their permission. This matters because it highlights the importance of consent when handling personal information. Even though no fines were imposed, the case emphasizes that companies need to be careful about how they share data.
What happened
The telecommunications company transmitted a customer's personal data to Schufa without explicit consent.
Who was affected
The customer whose personal data was shared with Schufa without their permission.
What the authority found
The court decided that the company lacked a valid legal basis for processing the customer's personal data, violating GDPR's requirements for consent.
Why this matters
This ruling shows that companies must ensure they have proper consent before sharing personal data. It serves as a reminder for all businesses to review their data-sharing practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject faile
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 13 O 220/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 13 O 220/23 - Germany (2024). Retrieved from cookiefines.eu
Last updated: