BVwG - W292 2342582-1/13E

Summary

A German court has ruled that data protection complaints filed by an association, whose business model relies on litigation funding and a profit-sharing agreement with data subjects, are invalid. The court found that the complaints were not lodged for the genuine protection of personal data but for financial gain, citing Article 57(4) GDPR. The association's systematic filing of over 900 similar complaints was deemed an abuse of data subject rights.

Full text

Help BVwG - W292 2342582-1/13E: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 09:13, 28 August 2026 view sourceLh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators14 edits Tag: Decisions [1.0] Latest revision as of 09:14, 28 August 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators14 editsTag: Visual edit Line 89: Line 89: === Facts ====== Facts === A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of [[Article 15 GDPR|Article 15 GDPR]]. The grounds of the violation were illustrated only rudimentary in the complaint. The DPA refused to act on the request on the basis of [[Article 57 GDPR|Article 57(4) GDPR]] because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of [[Article 15 GDPR]]. The grounds of the violation were illustrated only rudimentary in the complaint. The DPA refused to act on the request on the basis of [[Article 57 GDPR|Article 57(4) GDPR]] because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. Line 99: Line 103: === Holding ====== Holding === The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, [[Article 57 GDPR|Article 57(4) GDPR]] was applicable. The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, [[Article 57 GDPR|Article 57(4) GDPR]] was applicable. The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court.The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court. The decision of the DPA to reject the complaint instead of requesting the DPA to issue a fee for their activity pursuant to [[Article 57 GDPR|Article 57(4) GDPR]], which would be a less intrusive measure, was adequate. Because of the notorious activity of the association that is systematically disabling the work of the DPA, a fee would not be adequate to stop this activity.The decision of the DPA to reject the complaint instead of requ

Entities