No injunctive relief after GDPR violation?
The GDPR rightly imposes high hurdles on data controllers when processing personal data. According to Art. 79(1) GDPR, data subjects have the right to an effective judicial remedy if the controller processes the data subjects' personal data unlawfully. According to a questionable decision of the Wiesbaden Regional Court, data subjects allegedly cannot seek injunctive relief before a civil court.
What are the requirements for a lawsuit?
The plaintiff claimed before the Wiesbaden Regional Court that the website operated by the defendant processed personal data of the plaintiff, especially his IP address, via its own and third-party cookies and also transmitted it to third countries.
The Wiesbaden Regional Court already dismissed the action as inadmissible.
The plaintiff was not able to show which specific personal data were affected. The claim was therefore vague. Furthermore, the plaintiff was also unable to show when the data processing operations in question had taken place and whether they had taken place at all. Finally, the Wiesbaden Regional Court based its dismissal of the action on the lack of a basis for the claim.
Is there a right to injunctive relief in the GDPR?
The Wiesbaden Regional Court pointed out that an explicit right to cease and desist was not standardised in the GDPR. Although Articles 15 to 18 of the GDPR regulate the rights of data subjects, they do not include a right to injunctive relief. Art. 6 and Art. 44 of the GDPR, which the plaintiff invoked, were not the basis for a claim for injunctive relief.
The plaintiff could also not invoke the right to an effective judicial remedy set forth in Article 79(1) of the GDPR. According to the Wiesbaden Regional Court, only administrative or extrajudicial remedies remain unaffected under Article 79(1) of the GDPR. Recourse to civil courts was therefore not one of them. Thus, there would be a blocking effect, i.e. the plaintiff could not invoke Art. 79(1) GDPR.
Injunctive relief under data protection law pursuant to § 1004 BGB?
According to the Wiesbaden Regional Court, the plaintiff could not rely on injunctive relief under § 1004 BGB in conjunction with Art. 6 DSGVO. Article 6 of the GDPR. The GDPR is so-called "fully harmonised law" and conclusively regulates rights and remedies. The GDPR does not provide for a right corresponding to the right to injunctive relief under Section 1004 of the German Civil Code. There is also no opening clause for the applicability of national law. There is also no legal loophole. The data subject could turn to the supervisory authorities to punish a data protection violation.
Can you not demand an injunction from those responsible?
We think: YES!
We consider the ruling of the Wiesbaden Regional Court to be wrong.
The Wiesbaden Regional Court misunderstood the central provision of Article 79(1) of the GDPR. According to this norm, a data subject can complain about data protection violations in court, even if he or she can claim extrajudicial remedies or a right to complain to a supervisory authority in addition. This means that the aforementioned rights do not bar an action in court!
The argumentation of the Wiesbaden Regional Court also lacks any logic:
According to the Wiesbaden Regional Court, Article 17 of the GDPR, for example, is formulated as an explicit right of the data subject (in contrast to the right to injunctive relief), but the way to the civil courts via Article 79 (1) of the GDPR is generally closed. If, however, a data subject could not even assert a claim under Art. 15 to 18 GDPR before a civil court, the right to an effective judicial remedy codified in Art. 79(1) GDPR and the rules on jurisdiction would completely come to nothing!
Moreover, the Wiesbaden Regional Court fails to recognise the reality of supervisory authorities: it is not uncommon for supervisory authorities to discontinue investigation proceedings and refer the matter to the civil courts.
We are therefore of the opinion that you are entitled to injunctive relief against unlawful data processing, which you can and must also assert before a civil court. Our previous procedural experience supports our view.
Sources: Wiesbaden Regional Court, Judgment of 22.01.2022, Case No. 10 O 14/21
Please feel free to contact us if you suspect improper processing of your personal data. We look forward to talking to you. Furthermore, we are available to you as advisors in the entire area of IT/IP and data protection law.
GoldbergUllrich Lawyers 2022
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and
Specialist lawyer for information technology law
