The Wertheim Local Court imposed a penalty payment in the amount of €15,000. of €15,000.00 because the person obliged to provide information had not the origin of personal data in full.
What had happened?
On 27 May 2019, the Wertheim Local Court (Amtsgericht Wertheim ) ordered the later debtor of the penalty payment to provide information on the plaintiff's personal data. According to paragraph 1. g) of the acknowledgement judgment of 27.05.2019, the defendant was to provide all available information on the origin of the data in case the personal data had not been collected from the plaintiff.
The debtor of the periodic penalty payment stated in this regard that the data of the plaintiff originate from U.P. GmbH, for example, and that in addition to the plaintiff's the plaintiff's name, further personal data is stored. Which personal data of the plaintiff were stored, the debtor of the periodic penalty payment did not disclose.
The Wertheim Local Court found that the information provided by the debtor debtor did not meet the legal requirements for proper information and imposed a fine of and imposed a penalty payment of € 15,000.00, or, alternatively, one day's imprisonment for every € 500.00.
What was missing from the information?
The Wertheim Local Court stated that the information pursuant to Article 12 of the GDPR must be provided in a precise in a precise, transparent, comprehensible and easily accessible form in a clear clear and simple language. These requirements were met by the the information provided by the debtor of the periodic penalty payment.
The debtor has informed the court that the plaintiff's personal data is being plaintiff's personal data originated from U.P . GmbH. originated. The reader of the document can conclude from this that the data were transmitted to the defendant by the company U. P. GmbH. data were transmitted to the defendant by the company U. P. GmbH, but he does not have to draw this but he does not have to draw this conclusion.
The Communication of all available information about the origin of the data includes not only the communication from whom the data were transmitted, but also when and with what content personal data were transmitted. The debtor did not communicate the date of birth of the plaintiff, which was indisputably transmitted to her. date of birth of the plaintiff.
What information must be provided under the GDPR?
The decision of the Wertheim Local Court makes one thing clear. clear: Obligations under the GDPR should not be taken lightly, but seriously. should not be taken lightly, but seriously. Penalty payments affect the management of legal the management of legal entities directly and personally!
We have often experienced in our practice, that inadequate information was the prelude to an investigation by the supervisory by the supervisory authority. In this respect, we recommend that you seek extensive to obtain detailed advice before providing information.
Source:
Mosbach Regional Court, order dated 16.08.2019, ref. no. 5 T 49/19
Wertheim District Court, acknowledgment judgment of 27.05.2019, Ref. 1 C 66/19
GoldbergUllrich Lawyers 2020
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and specialist attorney for information technology law
