Court case 17 U 2/24 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that an electricity provider must remove negative payment information about a customer from a credit agency because it lacked a legal basis. This is significant as it emphasizes that companies must have valid reasons to share personal data with credit agencies.
What happened
The electricity provider shared a customer's payment information with a credit agency without a valid legal basis.
Who was affected
A customer who was affected by the negative payment information reported to the credit agency.
What the authority found
The court held that the electricity provider had no legal basis for processing the customer's data, and the customer was awarded €500 in damages.
Why this matters
This ruling reinforces the need for companies to ensure they have proper legal grounds before sharing personal data, especially with credit agencies.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The data subject had an electricity contract with an electricity provider. The electricity provider’s terms and conditions included the following paragraph: “For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.” The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee. In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services. In 2019, the electricity company conveyed the claim to the controller. In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency. In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid. The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well. Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance. The controller refused to remove the information from Schufa. Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR. Both the controller and the data subject appealed the decision to the Higher Regional Court Schlesw
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 17 U 2/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 17 U 2/24 - Germany (2024). Retrieved from cookiefines.eu
Last updated: