Court case 4 U 120/24 e – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a telecom provider legally shared a customer's data with a credit agency to prevent fraud. The court found that the provider had a valid reason for this action, which is important for protecting businesses from fraudulent activities. This case highlights the balance between data sharing and privacy rights.
What happened
The telecom provider disclosed a customer's data to SCHUFA Holding AG to prevent fraud.
Who was affected
The customer whose personal data was shared with the credit agency.
What the authority found
The court decided that the telecom provider had a legitimate interest in preventing fraud, fulfilling the legal requirements for data processing.
Why this matters
This ruling shows that companies can share data to prevent fraud, as long as they have a valid reason. Businesses should ensure they understand the legal grounds for sharing personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A telecom provider (the controller) concluded a contract with a customer (the data subject). Afterwards, the controller forwarded the subject’s data to the credit information agency SCHUFA Holding AG. The disclosure of the data were base on the controller’s interest in preventing fraud. The data subject brought an action with the Regional Court of Würzburg. He claimed that the disclosure of his data was unlawful. So, he required compensation for non-material damages under Article 82 GDPR, injunctive relief, and a declaration that the controller would be liable for all future material and non-material damages caused by the disclosure. The Regional Court of Würzburg dismissed the requests. The data subject then appealed the ruling with the Higher Regional Court of Bamberg. The Court dismissed the request and held that the controller lawfully disclosed the data to Schufa. In its analysis of the controller’s legitimate interest, the Court referred to the three requirements laid out by the case law of the Court of JusticeCJEU, Case C-252/21, Meta Platform and Others, 4 August 2023, margins 105 and following (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=276478&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=60751 here]). and held that they were fulfilled in the case at hand. First, the Court held that the controller had a real and legitimate interest in avoiding fraud. In this regard, the Court pointed out that many individuals conclude a large number of phone plans in a short time, without paying for those plans, in order to keep the phones that come with them. Credit information agencies such as the controller can help telecom providers avoid such frauds. Furthermore, the Court pointed out that Recital 47 GDPR lists fraud prevention as an example of a legitimate interest of the data controller. Then, the Court held that the processing of the data was necessary to prevent fraud. In the Court’s view, it was not apparent that less
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 4 U 120/24 e in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
5 May 2025
Authority
DPA LGWrzburg
About this data
Cite as: Cookie Fines. Court case 4 U 120/24 e - Germany (2025). Retrieved from cookiefines.eu
Last updated: