Landesbeauftragte für Datenschutz und Informationsfreiheit – Court Ruling (Germany, 2024)

In 2016, the data subject had been investigated and convicted due to tax evasion by a German Regional Court. The data subject alleged that the investigative file concerning him had been leaked to third parties including a journalist who used the contents of the file for their reporting. First, the data subject lodged a complaint with the DPA of the federal state of North Rhine-Westphalia (Landesbauftragte für Datenschutz und Informationsfreiheit des Landes Nordrhein-Westfalen – LDI NRW) in 2017 which was rejected on the ground that the the disclosure of court files forms part of the administration of justice and that the DPA lacks competence on this matter. In response to this, the data subject brought a case against the DPA to the Administrative Court Düsseldorf (Verwaltungsgericht Düsseldorf – VG Düsseldorf) in 2019. The claim was rejected as the complained of breach and the following proceedings had been concluded prior to the entry into force of the GDPR in 2018 (see 29 K 7031/19). However, the DPA treated the case taken by the data subject in 2019 as a complaint and began investigating the alleged data breach. The DPA requested information on the potential data breach from the Regional Court as well as all involved public prosecution offices. It did not request information from the tax investigation department as it considered this entity not to fall within its competence. On the 1 June 2022, the DPA issued a decision stating that it had found no violation of the data subject's rights. On the 4 July 2022, the data subject brought a case to the Administrative Court Düsseldorf (VG Düsseldorf) contesting the decision of the DPA dated 1 June 2022. The data subject alleged that the DPA did not diligently investigate the circumstances which in his eyes proves an active failure to act within its margin of discretion. He detailed that a violation should not be left unpunished just because it cannot be concretely identified. In addition, the data subject claimed t