Landesbeauftragte für Datenschutz und Informationsfreiheit – Court Ruling (Germany, 2024)

In 2016, the data subject had been investigated and convicted due to tax evasion by a German Regional Court. The data subject alleged that the investigative file concerning him had been leaked to third parties including a journalist who used the contents of the file for their reporting. First, the data subject lodged a complaint with the DPA of the federal state of North Rhine-Westphalia (Landesbauftragte für Datenschutz und Informationsfreiheit des Landes Nordrhein-Westfalen – LDI NRW) in 2017 which was rejected on the ground that the the disclosure of court files forms part of the administration of justice and that the DPA lacks competence on this matter. In response to this, the data subject brought a case against the DPA to the Administrative Court Düsseldorf (Verwaltungsgericht Düsseldorf – VG Düsseldorf) in 2019. The claim was rejected as the complained of breach and the following proceedings had been concluded prior to the entry into force of the GDPR in 2018 (see 29 K 7031/19). However, the DPA treated the case taken by the data subject in 2019 as a complaint and began investigating the alleged data breach. The DPA requested information on the potential data breach from the Regional Court as well as all involved public prosecution offices. It did not request information from the tax investigation department as it considered this entity not to fall within its competence. On the 1 June 2022, the DPA issued a decision stating that it had found no violation of the data subject's rights. On the 4 July 2022, the data subject brought a case to the Administrative Court Düsseldorf (VG Düsseldorf) contesting the decision of the DPA dated 1 June 2022. The data subject alleged that the DPA did not diligently investigate the circumstances which in his eyes proves an active failure to act within its margin of discretion. He detailed that a violation should not be left unpunished just because it cannot be concretely identified. In addition, the data subject claimed that he has a right to demand from the DPA to use its power under the GDPR in order to eliminate the rights violation. In his eyes, the abatement of action by the DPA violated Article 77 GDPR and Article 78 GDPR. Moreover, he demanded the court to commit the DPA to prohibiting the Regional Court and the public prosecutor's office from sharing personal data with the press or alternatively to annul the decision by the DPA dated 1 June 2022. The DPA submitted that as long as the courts are exercising their judicial functions, the DPA is stripped of its monitoring function. Where the DPA identified processing which fell within its competence, it investigated these. For the DPA, the central question was which department or person leaked the personal data to the press. The DPA requested information from the concerned departments but due to a lack of competence, the tax investigation department was not questioned. In the oral hearing, the data subject stated that he did not expect the DPA to take action against the tax investigation department. The court held, that the data subject’s claim is unfounded and that the decision dated 1 June 2022 by the DPA does not violate the data subject’s rights. Further, the data subject has no right to the requested prohibition of sharing personal data with the press executed by the DPA, as the Regional Court and public prosecutor are themselves responsible for the assessment on the lawfulness of the data processing. As state bodies, the Regional Court and the public prosecutor themselves decide on adequate purposes and means of the data processing. The court acknowledged, that objectively the data processing may have been unlawful as the data subject had not given consent and that the disclosure to the press was not necessary for the exercise of judicial functions. Regardless, the court declared that the data subject has no right to the issuance of regulatory measures by the DPA, as the controller remains unidentified. The questioned entities all responded to the requests of the DPA stating that no personal data had been disclosed to the press. This fact precludes the DPA from taking corrective action under Article 58(2) GDPR. If a controller cannot be identified, the DPA cannot work towards a remedy nor issue corrective measures or sanctions. The court declared, that Article 57 GDPR does not define the scope of investigation necessary for determining the controller. The court held that the DPA had appropriately exhausted its margin of discretion and that further questioning of the relevant institutions did not amount to a failure of appropriate assessment. The court declared, that there was no evidence indicating that the questioned persons violated the requirement to cooperate with the DPA under Article 31 GDPR nor that they unlawfully withheld information in violation of Article 58(1)(e) GDPR. The court highlighted that if the public prosecutors, who by their nature investigate suspects, could not determine a possible suspect for the alleged leak to the press it is justifiable for the DPA not to continue this investigation. In addition, the court found that there was no evidence suggesting that another institution subject to the competence of the DPA could have been responsible for the data breach. The court accepted that an on-site inspection of the concerning institutions and questioning of the involved employees was theoretically possible but would go far beyond the capacities of the DPA. Combined with the lapse of time, the low likelihood of determining the controller and the fact that only one data subject was affected by the breach rendered any further action unreasonable as it would impair the ability of the DPA to effectively deal with other complaints. The court also rejected the data subject’s claim for a new decision as it concluded that the DPA had investigated the data subject’s claim according to the significance of the violation to the data subject as well as the gravity of the violation.