No Claim for Injunction Following a GDPR Violation?
The GDPR rightly imposes significant hurdles on controllers concerning the processing of personal data. Pursuant to Art. 79 para. 1 GDPR, data subjects are entitled to an effective judicial remedy if the controller processes their personal data unlawfully. However, a questionable decision by the Wiesbaden Regional Court (LG Wiesbaden) suggests that data subjects are allegedly unable to assert a claim for injunctive relief before a civil court.
What are the requirements for a lawsuit?
The plaintiff asserted before the Wiesbaden Regional Court that the website operated by the defendant processed the plaintiff's personal data, particularly their IP address, via first-party and third-party cookies, and also transmitted it to third countries.
The Wiesbaden Regional Court dismissed the lawsuit as inadmissible.
The plaintiff failed to specify which concrete personal data was affected, rendering the claim indeterminate. Moreover, the plaintiff could not demonstrate when the data processing operations in question occurred, or indeed if they occurred at all. Ultimately, the Wiesbaden Regional Court justified its judgment dismissing the claim by citing a lack of a legal basis for the asserted claim.
Is there a claim for injunctive relief under the GDPR?
The Wiesbaden Regional Court noted that the GDPR does not explicitly codify a right to injunctive relief. While Articles 15 to 18 GDPR regulate data subjects' rights, a claim for injunctive relief is not included. Furthermore, Articles 6 and 44 GDPR, invoked by the plaintiff, were deemed not to provide a legal basis for such a claim.
The plaintiff was also unable to invoke the right to an effective judicial remedy enshrined in Art. 79 para. 1 GDPR. In the Wiesbaden Regional Court's opinion, Art. 79 para. 1 GDPR merely preserves administrative or extrajudicial remedies, thereby excluding recourse to civil courts. This interpretation would create a preclusive effect, preventing the plaintiff from relying on Art. 79 para. 1 GDPR.
Claim for injunctive relief under data protection law pursuant to § 1004 German Civil Code (BGB)?
According to the Wiesbaden Regional Court, the plaintiff could also not invoke a claim for injunctive relief under § 1004 German Civil Code (BGB) in conjunction with Art. 6 GDPR. The GDPR is considered 'fully harmonized law,' exhaustively regulating rights and remedies. It does not provide for a right equivalent to the injunctive relief claim under § 1004 BGB, nor does it contain an opening clause for the applicability of national law. The court further argued that there is no gap in legal protection, as data subjects can address data protection violations by contacting the supervisory authorities.
Can you not demand injunctive relief from controllers?
We believe: YES!
We deem the Wiesbaden Regional Court's judgment erroneous.
The Wiesbaden Regional Court has misinterpreted the central provision of Art. 79 para. 1 GDPR. According to this norm, a data subject can challenge data protection violations in court, even if they can additionally assert extrajudicial remedies or a right to complain to a supervisory authority. This implies that the aforementioned rights do not preclude a lawsuit before a court!
The Wiesbaden Regional Court's argumentation also lacks any logical foundation:
According to the Wiesbaden Regional Court's reasoning, while Art. 17 GDPR, for example, is formulated as an explicit right of the data subject (unlike a claim for injunctive relief), access to civil courts via Art. 79 para. 1 GDPR is fundamentally precluded. However, if a data subject could not even assert a claim derived from Articles 15 to 18 GDPR before a civil court, the right to an effective judicial remedy codified in Art. 79 para. 1 GDPR and the provisions on judicial jurisdiction would be rendered entirely meaningless!
Moreover, the Wiesbaden Regional Court misunderstands the reality of supervisory authorities: it is not uncommon for supervisory authorities to close investigation proceedings and refer complainants to civil litigation.
We are therefore of the opinion that you are entitled to a claim for injunctive relief against unlawful data processing, which you can and indeed must assert before a civil court. Our extensive procedural experience supports this perspective.
Sources: Wiesbaden Regional Court, Judgment of 22.01.2022, Ref. 10 O 14/21
Please do not hesitate to contact us if you suspect any misuse in the processing of your personal data. We look forward to a discussion with you. Furthermore, we are readily available to advise you on all aspects of IT, IP, and data protection law.
GoldbergUllrich Attorneys-at-Law 2022
Julius Oberste-Dommes LL.M. (Information Law)
Attorney-at-Law and
Specialist Attorney for Information Technology Law
