In the decision of April 23, 2019 on GZ DSBD123.626/0006-DSB/2018, the data protection authority had to deal with the question of whether it is permissible to collect personal data from the land register and subsequently use it to contact persons by mail for the purpose of possibly acquiring a property. After receiving the said letter, the complainant alleged a violation in the right to confidentiality.
The data protection authority first stated that the data in question is personal data, which is accessible in the land register, a public register. However, in the opinion of the data protection authority, the very general assumption of the non-existence of a violation of confidentiality interests worthy of protection for permissibly published data is not compatible with the provisions of the GDPR. Furthermore, the respondent did not limit itself to the mere reproduction of these publicly available data, but a new element was linked to these data, namely the use of the data for the possible acquisition of properties in the context of the trade as a real estate trustee. Since, according to the case law of the data protection authority, such a link always requires an element of permission and the respondent has relied on legitimate interests in this context, a balancing of interests had to be carried out.
In this regard, it should first be noted that due to the fact that the personal data of the complainant is already publicly accessible in the land register and it is obvious that this is not sensitive data and also not data relevant under criminal law,
a lower degree of protection is to be assumed in principle. The complainant was only contacted once by mail and the personal data was not used in any other way. In addition, the respondent, as a real estate trustee, has the interest,
continuously acquire properties or land that it considers to be of economic interest. Furthermore, the respondent also offered to delete the complainant’s personal data or to refrain from contacting him again. Conversely, the complainant has not put forward any confidentiality interests worthy of protection, nor were any such interests discernible.
The data protection authority therefore concluded that, based on the balancing of interests carried out, there was no violation of the right to confidentiality, as the legitimate interests of the respondent as a real estate trustee outweighed the impairment of the legitimate interests of the complainant in this case. This decision is legally binding.
In contrast, in its decision of May 20, 2019, GZ: DSB-D123.972/0005- DSB/2019, the data protection authority had to deal with whether the interests of a real estate trustee outweigh those of the data subject, even in the case of repeated contact. Specifically, the respondent contacted the complainant by means of letters twice within a month and three times within a period of just over a year to ascertain the complainant’s intentions to sell. In this case, the balance of interests was in favor of the data subject, who has a legitimate interest in not having his or her personal data processed on a permanent basis for the purpose of regular inquiries regarding a possible sale of real estate. In the present constellation, this interest outweighs the economic interest of the respondent, as a result of which the complainant’s right to confidentiality was violated.
Furthermore, in the same decision, the respondent was ordered to provide the complainant with information on the legal basis for the processing of his personal data (Art. 14(1)(c) GDPR), on the duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration (Art. 14(2)(b) GDPR) and, if the processing of the personal data of the complainant is not possible, on the criteria for determining this duration (Art. 14(2)(b) GDPR).
Complainant on Art. 6 para. 1 lit f GDPR, the legitimate interests pursued by the respondent in the processing (Art. 14(2) lit b GDPR), as the complainant was not informed about this information either in the three letters sent to him or during the proceedings before the data protection authority, and the complainant has alleged a breach of the information obligations by the respondent. This decision is not legally binding.