Court case 13 O 156/24 – Court Ruling (Germany, 2025)

The controller is the provider of a social network based in the United States. It stores personal data on several different servers, some of which are in the US. The data subject is a user of the controller’s social network, which made an access request under Article 15 GDPR. The controller partly refused to provide the data subject with information under Article 15 GDPR. The refusal concerned possible access to data by US intelligence services. The controller referred to national law (Section 702 of the US Foreign Intelligence Surveillance Act of 1978), under which it is forbidden for the controller to provide the data subject with such information. The data subject sued the controller before the court of first instance (Regional Court of Bonn, Landgericht Bonn - LG Bonn) for, inter alia, €1,500 in non-material damages for the allegedly illegal transfers of personal data to the U.S. Furthermore, he claims another €1,000 in non-material damages for the refusal of the controller to provide the data subject with a copy of his personal data under Article 15 GDPR. The controller claimed that the data transfer to the US was justified, because it is necessary for the performance of the contract, which follows from the nature of a digital, international, social network. It also insisted that is was not permitted to provide information regarding the access of US intelligence services. The court found that the lawsuit was partly inadmissible and partly unfounded. First, the court found that the personal data transfers to the US between the coming into effect of the GDPR until the 9 July 2023 had been legal under Article 49(1)(b) GDPR. Since 10 July 2023 they were and are legal under Article 45(1) GDPR due to the adequacy decision by the European Commission. Second, the court followed the argument of the controller that it was in the very nature of an international social network that personal data can potentially be accessed world wide and therefore need to be able to be saved world wide in order for the controller to be able to provide their services. The court acknowledged that it is at least necessary to temporarily save the data in a cache in the US to provide US users with the profile information of the data subject. The court found that it doesn’t matter if the user really has platform friends in the US but rather that the controller has to ensure that their services are working properly world wide. Therefore, at least infrastructure for international caching of data was necessary. Third, the court also held that the data subject had at least implicitly consented to the international transfer of data under Article 6(1)(a) GDPR because every user of a US based social network had to know that their data would potentially be stored in the US in order for the social network to function properly. It didn’t matter, as the court holds, that the data subject had his contract with an Irish subsidiary, because everyone knew that a US company was behind this social network. Fourth, regarding the controller’s refusal to provide the data subject with information about data transfers to US intelligence services the court did not see a justification for this refusal under the national data protection law (§ 29(1) German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)) because it only referred to other German laws that prohibit providing the data subject with information under Article 15 GDPR. The court furthermore held, that Article 15(4) GDPR was also not a legal basis for a refusal to provide information in this case because there were no rights and freedoms of others concerned by a law in the US. However, the court held that the controller’s refusal can be relied on the general justification of a legal emergency, in its specific form of an unresolvable conflict between obligations. Lastly, the court held that the German public has known for many years that the US did not have a comparable level of data protection and therefore a user has to expect that a US based company had to comply with such US laws. Even though the US had a government with anti-democratic, anti-rule of law, autocratic and fascist tendencies, and despite the deficits in freedom and data protection rights, the US still had to be viewed as a democratic and rule of law state. Therefore, it needs to be allowed for US companies that do business in the EU to comply with US laws.