Court case 13 O 220/23 – Court Ruling (Germany, 2024)

The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject failed to present the court with a sufficient legal interest which is needed for such a declaratory judgement under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0950 § 256 German Civil Process Order (Zivilprozessordnung – ZPO)]. In cases of declaratory judgements concerning future material damages the admissibility of such an action is depends on the probability of such a damage. The data subject needs to present the court with sufficient facts and bears the burden of proof. Even when considering just the data subject’s claims, the court found that there was no plausible future damage. Concerning the non-material damages, the lawsuit was dismissed. The criteria of Article 82(1) GDPR were not met. The court held that there was no GDPR infringement since the controller could rely on Article 6(1)(f) GDPR for the data transfer to Schufa. The court admitted that in the German case law there is a controversy on the question whether the right to privacy and data protection of the data subject outweighs the controller’s claimed legitimate interests (fraud prevention, overborrowing, and credit risk prognosis). In similar cases, some other courts held that the rights and interests of the data subject took precedence over the controller's legitimate interests ([https://gdprhub.eu/index.php?title=LG_Stuttgart_-_27_O_60/24 see for example LG Stuttgart 27 O 60/24]). The court in the present case, however, decided that the interests of the controller superseded. The court held that also the data subject had an indirect interest in the transfer of their data since risk minimization for the controller had to result in lower prices for the consumer. Furthermore, the so called positive data (like the data about the conclusion of the contract) were less invasive than negative data (e. g. about customers failing to pay). Also, a lack of positive data can lead to a negative bias in the scoring of the controller. The data subject also failed to present the court with facts that the transfer of the personal data in this case had a negative effect on his score. These facts had to be taken into account in the weighing of the conflicting positions at hand. Finally, the court stated that the constant fear of negative questions about his creditworthiness claimed by the data subject were not plausible because the transferred data are neutral.