Court case 17 U 2/24 – Court Ruling (Germany, 2024)

The data subject had an electricity contract with an electricity provider. The electricity provider’s terms and conditions included the following paragraph: “For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.” The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee. In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services. In 2019, the electricity company conveyed the claim to the controller. In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency. In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid. The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well. Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance. The controller refused to remove the information from Schufa. Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR. Both the controller and the data subject appealed the decision to the Higher Regional Court Schleswig (Oberlandesgericht Schleswig – OLG Schleswig). The OLG Schleswig held that the data subject had no right to non-material damages but upheld the LG Kiel judgement insofar as it had ordered the controller to withdraw the information from Schufa. = The unlawfulness of the notification by the controller to Schufa followed from the fact that the interest of the data subject outweighed the legitimate interest of the controller. The only possible legal basis for the processing was Article 6(1)(f) GDPR. Generally, there was a legitimate interest of Schufa users and the public for the transfer of data about missed payments. The special provision for scoring agencies in § 31 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) could only indirectly provide criteria for the balancing under Article 6(1)(f) GDPR. Thus, the fact that one of the alternative criteria for the lawfulness of scoring is fulfilled cannot in itself constitute a prevailing legitimate interest. On the other hand, it cannot be necessarily argued that there was a strict limitation to the criteria from § 31 BDSG. Hence, the court left the possibility for cases other than § 31 BDSG that could constitute a prevailing legitimate interest for a notification to the credit rating agency. However, in this case, the court stuck to the criteria of § 31 BDSG and found that none of these were matched. The court already doubted the legitimacy of some of the claims. Concerning § 31(2)(5) BDSG that provides that data about unpaid claims may be used for scoring if they allow the claimant to terminate the contract without a deadline, the court held, that this would only apply to the original claim itself, not to alleged further damages. Furthermore, the court found that it could not properly tell both apart in this case due to the opaque information provided by the controller. Thus, the court found that the transfer to Schufa could not even be partially based on § 31(2)(5) BDSG. Furthermore, it referred to sentence 3 of Recital 47 which provides that at any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. Because the claims of the controller objectively fell under the statute of limitations already when the controller forwarded them to Schufa for the first time the court held that the data subject did not need to reasonably expect a transfer of data concerning these claims, even though the data subject had not yet invoked the statute of limitations. Therefore, the court held, there was no legitimate interest in this case. = While explicitly not deciding if an injunctive relief (Unterlassungsanspruch) could be based on the GDPR directly, the court argued that the GDPR does not prohibit to use other legal basis for an injunctive relief from national law because the GDPR did not have a blocking effect on domestic law due to its aim of broad protection of personal data. Only the complementary application of domestic law ensured that this aim was reached. In this case, the right to obtain an injunctive relief followed from an analogy of [https://www.gesetze-im-internet.de/bgb/__1004.html § 1004(1)] and [https://www.gesetze-im-internet.de/bgb/__823.html § 823(1)] of the German Civil Code (Bürgerliches Gesetzbuch – BGB) in conjunction with Article 6(1) GDPR. = However, there was no right for non-material damages under Article 82(1) GDPR because, despite the GDPR infringement, the data subject was not able to show a concrete non-material damage apart from the mere loss of control. The court allowed an appeal to the German Federal Court of Justice (Bundesgerichtshof – BGH).