Disclosure of personal data for the enforcement of civil law claims Summary Our remarks An individual who did not have a Facebook Messenger • The right to access personal data under the account learned that her personal data was being GDPR also applies to individuals who are not discussed in a group chat on Messenger by her family users of a particular service. In this case, the members. person who did not have a Facebook Messenger account was still entitled to access the personal The family members wrote messages like “She is the data being discussed about her in a group chat biggest bitch” or “What a disgrace she is for the proud on Messenger. family”. In addition to the insulting content, the family members made false factual claims about her. • The right to privacy is an important consideration in determining whether an The individual requested access to the information individual should be granted access to personal being disclosed about her in the group chat including data, as there can be opposing privacy IP addresses of the users, the messages, e-mail rights that need to be assessed. The German addresses of the users etc. to have the opportunity Court found that the person’s right to privacy to establish a civil claim. This request was denied by outweighed Facebook’s interests in protecting Facebook. the privacy of other Messenger users. The Individual then filed a complaint with the Irish Data • The case shows how GDPR can influence the Protection Comission (DPC), as Facebook’s European application of other laws. The Court concluded headquarters are in Ireland. The Irish DPA referred that TMG’s provisions regarding the disclosure the case to the German Federal Court of Justice of user data for the enforcement of civil law (Bundesgerichtshof) as the applicant was German. claims must be applied in accordance with The case raised questions in relation to whether the GDPR’s requirements of necessity and the information could be provided according to the proportionality. German Telemedia Act (TMG) and the GDPR. • The ruling highlights the importance of The Court found that Facebook Messenger comes transparency and accountability in data under the purview of the TMG, which allows service processing practices. The GDPR requires providers to disclose user data to enforce civil law companies to be transparent about their claims. Furthermore, the Court deemed this disclosure data processing practices and to ensure that as a necessary and proportionate action within a individuals can exercise their rights to access, democratic society, in line with GDPR, Article 23(1)(j). rectify, and delete their personal data. The Decision of the German federal Court The German federal Court ruled that according to GDPR, Article 17, the individual had the right to be provided with the personal data being discussed about her in the group chat on Messenger. Published: 24-09-2019 Journal number: VI ZB 39/18 Tags: Right to access and obligation to provide information 67