Court case 10 O 4/24 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a telecommunications company unlawfully shared customer data with credit agencies without proper consent. The court's decision came after a user complained about losing control over their personal information. This case reinforces the need for companies to obtain consent before sharing personal data.
What happened
A telecommunications company transmitted customer data to credit agencies without the user's consent.
Who was affected
The user who entered into a mobile phone contract and had their data shared without permission was affected.
What the authority found
The court found that the transmission of data to credit agencies violated GDPR rules that require user consent.
Why this matters
This ruling sets a precedent that companies must secure explicit consent before sharing personal data. It serves as a reminder for businesses to review their data-sharing practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
On 22 November 2019, a data subject entered into a mobile phone contract with the controller (a telecommunications company). The telecommunications company transmitted to 2 credit information agencies so called 'positive data' about the data subject, in particular information about the commissioning and execution of the contract which included data required to identify the respective person. The data subject received a leaflet regarding the transmission of data to S with a reference to a right of objection. On 19 October 2023, one of the credit information agencies published a press release stating that it would delete customer account information relating to the constoller. This decision was due to following the assessment of the Data Protection Conference of the German States (DSK) and the body of the independent German federal and state data protection supervisory authorities that the transmission and processing of data from the telecommunications sector by credit information agencies for credit scoring cannot be based on a "legitimate interest" according to Article 6(1)(a) of the GDPR and consent is required. The data subject filed a case before the court of first instance (Regional Court of Itzehoe- LG Itzehoe) requesting that the controller is ordered to compensate them for immaterial damages for the data protection breach, cease and desist transmitting their personal data to the credit information agencies and compensate them for all future damages that the plaintiff has suffered and/or will suffer as a result of the unauthorized transmission. They claim that they did not consent to having their personal data shared with the credit information agencies and that the transmission is unlawful and violated Article 6(1) and Article 5(1)(a) GDPR. They alleged it caused non-material damage in the form of loss of control over their data deriving from the transmission, impact on economic decisions and financial freedom, and suffering fear of data loss and sleep dis
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 10 O 4/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 10 O 4/24 - Germany (2024). Retrieved from cookiefines.eu
Last updated: