BVerwG - 6 C 3.23

BVerwG - 6 C 3.23
Court:	BVerwG (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(f) GDPR
Decided:	29.01.2025
Published:	16.04.2025
Parties:
National Case Number/Name:	6 C 3.23
European Case Law Identifier:	ECLI:DE:BVerwG:2025:290125U6C3.23.0
Appeal from:	OVG Saarlouis (Germany) 2 A 111/22
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	BVerwG (in German)
Initial Contributor:	tjk

The court held, that telephone advertising cannot be used

English Summary

Facts

The controller purchases precious metal residues from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The controller uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the controller.

By order of 10 January 2017, the DPA ordered the controller to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the DPA ordered the deletion of the data collected and stored for this purpose and instructed the controller to implement the ordered measures within two weeks of the order becoming final and to notify the DPA thereof.

The controller applied to the DPA for annulment of the decision. As grounds, she essentially argued that her conduct was lawful under the GDPR, which had since entered into force, so that a new issuance of the order would not be possible.

By order of March 25, 2020, the DPA rejected the application, essentially stating: The legal situation had not changed in the controller's favor.

The Administrative Court dismissed the controller's action seeking an order requiring the DPA to annul its decision of 10 January 2017. The Higher Administrative Court held that in the absence of consent under Article 6(1)(a) GDPR, the admissibility of the controller's data processing for direct marketing purposes now depends on the applicability of Article 6(1)(f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other. However, the requirements of Article 6(1)(f) GDPR are not met because the telephone advertising practiced by the controller does not meet the requirements of the Unfair Competition Act.

With the appeal, the controller is pursuing its request further claiming that it can rely on Article 6(1)(f) GDPR as the legal basis for its data collection and processing.

Holding

Controller violated GDPR

The court held, that the controller's conduct, which was prohibited by the DPA's final decision of 10 January 2017 based on the then-current version of the Federal Data Protection Act, violates the requirements of the now applicable GDPR. This is because the controller processes personal data of the dentists concerned without their consent.

The court held, that contrary to the opinion of the lower court Article 95 GDPR does not render Article 6(1)(f) GDPR inapplicable in this case, because Article 13(3) of the e-privacy directive does not constitute a provision in relation to which the GDPR imposes "additional obligations" on natural or legal persons. The court found that rather Article 13(3) of the e-privacy directive contains stricter requirements with regard to unsolicited direct marketing communications than the GDPR.

The court found, that while the GDPR also lays down general rules in this regard, Article 13(3) e-privacy directive leads to an expansion of the controller's obligation to refrain from processing personal data without express consent. Therefore, the court held that Article 6(1)(f) GDPR and Article 13(3) of the e-privacy directive are, in principle, applicable concurrently.

Unfair Competition Act (UWG) must be taken into account

However, the court held, that when assessing whether the data processing is carried out to safeguard a "legitimate interest", the assessments of Section 7(2)(1) UWG must be taken into account.

The court found that the fundamental question of whether standards and valuations of national law may generally be applied when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR can remain open since the German legislator implemented Article 13 of the e-privacy with Section 7(2)(1) UWG. It would, the court held, be in any event contrary to the principle of the unity of the Union legal order, if this implementation of Article 13 of the e-privacy directive, which is applicable in accordance with Article 95 GDPR alongside the GDPR, had to be disregarded when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR.

Additionally, the court considered, the CJEU had held that the coexistence of remedies under data protection law and competition law does not pose a threat to the uniform enforcement of the GDPR.

Processing violates Unfair Competition Act

The court found, that the controller lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR because the purpose of its data processing violates Section 7(2)(1) UWG.

According to Section 7(2)(1) UWG, a commercial practice that unreasonably harasses a market participant is impermissible. According to Section 7(1) UWG, this applies in particular to advertising, even though it is evident that the market participant addressed does not want this advertising. Following on from this, Section 7(2)(1) UWG stipulates that unreasonable harassment is always to be presumed when advertising is carried out by telephone to a consumer without their prior express consent or to another market participant without their at least presumed consent.

Presumed consent requires that, based on specific factual circumstances, the caller can be presumed to have a legitimate interest in the telephone advertising. The court held that such an objectively justified interest of dentists in the sale of precious metal residues to the controller could not be established. The court held that an interest could not be inferred simply from the fact that the dentists called published their telephone numbers in publicly accessible directories, as this served solely to ensure accessibility for patients. The sale of precious metal residues for profit is neither typical nor essential to the work of a dentist. Moreover, the retention of precious metal residues in the possession of the dentist is likely to be the exception, as they are usually handed over to the patient concerned as their owner after dental treatment, who can dispose of them as they see fit.

No discretion of the DPA

The court held that the discretion generally granted to the DPA under the GDPR is limited in the present case to the extent that the DPA must intervene and impose a ban on the processing of the personal data of dental practice owners without their consent for the purpose of telephone advertising pursuant to Article 58(2)(f) GDPR.

Inaction by the DPA is clearly not an option in the present case because the he controller expressly intends to continue the data processing complained of by the DPA.

With regard to the selection of the specific remedial measure, the discretion generally granted to the DPA under Article 58(2) GDPR is limited in the present case to the extent that only a prohibition pursuant to Article 58(2)(f) GDPR is appropriate, necessary, and proportionate to remedy the identified infringement of the GDPR.

The imposition of a fine referred to in Article 58(2)(i) GDPR is not a less intrusive measure than the prohibition based on Article 58(2)(f) GDPR. Furthermore, Article 58(2)(i) and Article 83(2)(1) GDPR clarify that a fine may be imposed not only instead of, but also in addition to, the other measures referred to in Article 58(2) GDPR. The controller could not obtain a new decision on the application for reopening the proceedings by arguing that the authority failed to consider the possibility of a less favorable decision for the controller in its discretionary considerations.

The court held, that in the case of the controller's data processing for the purpose of telephone advertising without the express consent of the dentists called, neither a warning pursuant to Article 58(2)(a) GDPR nor a reprimand pursuant to Article 58 (2) (b) GDPR can be considered appropriate remedial measures. Since the controller already lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR, it is clear that a design of the processing in question that complies with data protection law is not possible thus establishing an enforceable legal obligation for the controller to cease the processing is necessary.

Comment

Despite not needing to decide the question the court considered that the general possibility of specification by national law is contradicted by the fact that Member States are not empowered to adopt supplementary provisions for the application of the conditions for lawfulness set out in Article 6(1)(a), (b), and (f) GDPR, since such a power is limited under Article 6(3) GDPR to the grounds set out in Article 6(1)(c) and (e) GDPR. With regard to Article 6(1)(f) GDPR the court held, that the CJEU had further clarified that Member States may not conclusively prescribe the outcome of the balancing of conflicting rights and interests.

On the other hand, the court considered, that the most recent case law of the CJEU provides strong evidence that, when assessing whether a legitimate interest within the meaning of Article 6(1)(f) GDPR is exercised, provisions of national law may also be taken into account, provided they do not have any data protection-specific content and thus do not pose a risk of circumventing the opening clauses provided for in the GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Judgment

BVerwG 6 C 3.23

Saarlouis Administrative Court - December 15, 2021 - Case No. 5 K 461/20
Saarlouis Higher Administrative Court - April 20, 2023 - Case No. 2 A 111/22

In the administrative dispute, the 6th Senate of the Federal Administrative Court, following the oral hearing on January 29, 2025, by the Presiding Judge of the Federal Administrative Court, Prof. Dr. Kraft, the Judges of the Federal Administrative Court, Dr. Möller and Hahn, and the Judges of the Federal Administrative Court, Steiner and Dr. Gamp,
has ruled:

The plaintiff's appeal against the judgment of the Saarland Higher Administrative Court of April 20, 2023, is dismissed.

The plaintiff shall bear the costs of the appeal proceedings.

Reasons
I

1
The plaintiff purchases precious metal residues from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The plaintiff uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the plaintiff. In the initial telephone call, the plaintiff also explains its services and, if interested, the possible next steps.

2
By order of January 10, 2017, the defendant ordered the plaintiff, on the basis of Section 38 (5) Sentence 2 of the Federal Data Protection Act in the version valid until May 24, 2018 (BDSG old version), to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the defendant ordered the deletion of the data collected and stored for this purpose and instructed the plaintiff to implement the ordered measures within two weeks of the order becoming final and to notify the defendant thereof. In the event that the plaintiff fails to comply with the orders, does not comply fully, or does not comply within the specified period, a coercive fine of €2,500 was threatened and simultaneously imposed subject to a condition precedent. The action filed against this order was unsuccessful. The Higher Administrative Court rejected the plaintiff's application for leave to appeal against the Administrative Court's dismissing judgment by order of September 10, 2019.

3
By letter from her legal representatives dated October 9, 2019, the plaintiff applied to the defendant for annulment of the decision of January 10, 2017. As grounds, she essentially argued that her conduct was lawful under the General Data Protection Regulation (GDPR), which had since entered into force, so that a new issuance of the order would not be possible.

4
By order of March 25, 2020, the defendant rejected the application, essentially stating: The legal situation had not changed in the plaintiff's favor. The contested order would now be upheld on the basis of Article 58(2)(f) in conjunction with Article 6(1)(f) of the GDPR. 1 letter f GDPR. In the context of the balancing of interests pursuant to Article 6 (1) subparagraph 1 letter f GDPR, the provision of Section 7 (2) no. 2 of the Act against Unfair Competition (UWG), which is based on the opening clauses of Article 13 (3) and (5) of Directive 2002/58/EC, must be taken into account. This is because Article 95 GDPR in conjunction with Recital 173 of the GDPR provides for the coexistence of the directive and the regulation. Since there is no presumed consent of the addressees within the meaning of Section 7 (2) no. 2 alternative 2 of the UWG in the version applicable at the time, the data processing is not permissible due to a lack of legitimate interest within the meaning of Article 6 (1) subparagraph 1 letter f GDPR. Even a discretionary decision leads to the conclusion that the final order must be upheld.

5
The Administrative Court dismissed the plaintiff's action seeking an order requiring the defendant to annul the decision of January 10, 2017. The Higher Administrative Court dismissed the plaintiff's appeal on the grounds that there were no grounds for reopening the case under Section 51 (1) No. 1 of the Saarland Administrative Procedure Act (SVwVfG). The provisions of the General Data Protection Regulation did not constitute a change in the legal situation in favor of the plaintiff. In the absence of consent under Article 6 (1) (a) GDPR, the admissibility of the plaintiff's data processing for direct marketing purposes now depends on the applicability of Article 6 (1) (f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other.

6
However, the requirements of Article 6 (1) (f) GDPR are not met because the telephone advertising practiced by the plaintiff does not meet the requirements of Section 7 (2) No. 1 of the Unfair Competition Act (UWG) in the version of August 10, 2021. This competition law provision must be considered in the context of data protection law because it is a single process in which personal data is used for an unauthorized advertising approach. Due to the continued validity of the opening clause in Article 13 (3) of Directive 2002/58/EC, which allows Member State regulations prohibiting telephone advertising without the consent of the subscriber concerned, Article 6 (1) (f) GDPR cannot be used as a legal basis for data processing for the purpose of telephone advertising. Rather, consideration of Section 7 Paragraph 2 No. 1 of the Unfair Competition Act is permissible. The term "telephone advertising" covers all calls intended to promote the sale of goods or the provision of services. Accordingly, from both a competition law and a data protection law perspective, advertising calls to consumers are only permissible with the express consent of the recipient. In the absence of such declarations of intent from those addressed - as is the case here - advertising calls constitute unreasonable harassment without exception under Section 7 Paragraph 2 No. 1 of the Unfair Competition Act. The fact that Article 13 Paragraphs 3 and 5 of Directive 2002/58/EC does not distinguish between consumers and other market participants, but only between natural and legal persons, can be taken into account by interpreting Section 7 Paragraph 2 No. 1 of the Unfair Competition Act in accordance with the directive, thereby achieving uniform protection for natural persons within the meaning of data protection law harmonised in various legal acts.

7
If the advertising were related to the professional activities of the dentists addressed, there would in any case be no presumed consent within the meaning of Section 7 (2) No. 1 Alternative 2 of the Unfair Competition Act (UWG). This is because no objectively justified interest of dentists in selling precious metal residues to the plaintiff can be established. The fact that they publish their telephone numbers in publicly accessible directories serves solely to ensure accessibility for patients. The sale of precious metal residues for profit is neither typical nor essential to the work of a dentist. Moreover, precious metal residues are usually handed over to the affected patient after dental treatment, who, as owner, can dispose of them as they see fit. If it is therefore established that the – express or presumed – consent required under Section 7 (2) No. 1 of the UWG does not exist, the plaintiff is precluded from relying on the legal basis of Article 6 (1) Subparagraph 1 (f) of the GDPR to justify its business practice.

8
Even if Article 6 (1) (f) GDPR were considered generally applicable, the plaintiff's legitimate interest would be denied due to the anti-competitive processing, with the result that a balancing of interests would also be to its detriment. In order to give shape to the general legal basis of Article 6 (1) (f) GDPR and to ensure legal certainty, it would be appropriate to use specific legal grounds from existing national law for its interpretation. Due to the continued validity of Article 13 (3) of Directive 2002/58/EC, the assessment of Section 7 (2) No. 1 of the Unfair Competition Act (UWG) must be taken into account, with the result that the plaintiff cannot rely on an overriding "legitimate" interest within the meaning of Article 6 (1) (f) GDPR.

9
The defendant's order is also not objectionable from a discretionary perspective. An obligation to issue a new decision is therefore also out of the question. If the supervisory authority determines a violation of data protection provisions, its discretion is generally limited, in accordance with the General Data Protection Regulation, to the extent that it can exercise its remedial powers.

10
The plaintiff is also not entitled to a retrial of the proceedings under Section 51 (5) in conjunction with Sections 48 and 49 of the Administrative Procedure Act. In this respect, there is only a right to the correct exercise of discretion. If the maintenance of the final administrative act cannot be qualified as absolutely intolerable – as is the case here – it is generally not an error of discretion to give priority to legal certainty.

11
With the appeal on points of law admitted by the Higher Administrative Court, the plaintiff is pursuing its request further. It considers the requirements of Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG) to be met. Based on the change in the legal situation in favor of the plaintiff resulting from the entry into force of the General Data Protection Regulation, the order of January 10, 2017, cannot be upheld. This order is based on the fact that the requirement of Section 28 (3) Sentence 6 of the Federal Data Protection Act (BDSG) (old version) was missing, according to which the "storage" of data pursuant to Section 28 (3) Sentence 3 of the Federal Data Protection Act (BDSG) (old version) is only permissible to the extent that this does not violate legitimate interests, which is to be assumed in particular if the Act against Unfair Competition classifies a certain form of advertising as unreasonable harassment. The plaintiff can now rely on Article 6 (1) Subparagraph 1 Letter f of the GDPR as the legal basis for its data collection and processing. With this standard, the Union legislator has opted for a flexible balancing of the legitimate interests of the controller and the interests of the data subject.

12
Contrary to the Higher Administrative Court's opinion, the application of Article 6 (1) (f) GDPR is neither barred by Section 7 (2) No. 1 of the Unfair Competition Act, nor are assessments of Article 7 (2) No. 1 of the Unfair Competition Act to be taken into account in the balancing of interests to be carried out pursuant to Article 6 (1) (f) GDPR. As a data protection authority, the defendant is not authorized to apply competition law. Article 95 of the GDPR clarifies that the provisions of the General Data Protection Regulation and the Act against Unfair Competition apply concurrently. This precludes the application of Section 7 (2) No. 1 of the Unfair Competition Act within the framework of Article 6 (1) (f) GDPR. If a national regulation could influence the balancing of interests, this would contradict the intention of the Union legislature to establish a uniform level of data protection.

13
That the processing of personal data for the purpose of direct marketing serves a legitimate interest within the meaning of Article 6 (1) (f) GDPR is clarified by Recital 47 of the GDPR. The term "direct marketing" is to be interpreted broadly and encompasses any data processing for commercial purposes. The plaintiff's type of demand-based advertising by means of telephone calls is also necessary to achieve the purpose of the processing. The balancing of interests is in the plaintiff's favor. It should be considered, above all, that this concerns business contact data that have been made publicly accessible and are therefore less worthy of protection.

14
Even if Section 7 (2) No. 1 of the Unfair Competition Act (UWG) were to be considered in the context of the balancing of interests under Article 6 (1) (f) GDPR, the plaintiff's conduct complained of does not violate this provision. Since the opening clause in Article 13(3) of Directive 2002/58/EC only covers direct advertising, Section 7(2) No. 1 of the Act Against Unfair Competition (UWG) should be interpreted in accordance with the directive as not applying to less intrusive demand-side advertising. Furthermore, the dentists contacted are not consumers within the meaning of this provision, as the primary focus is on business contact. Presumed consent within the meaning of Section 7(2) No. 1 of the Act Against Unfair Competition (UWG) exists. This is because, through the sale of precious metals, the dentists contacted could generate additional profit with positive effects on the development of their respective practices.

15
The defendant defends the judgment of the Higher Administrative Court.

II

16
The plaintiff's appeal is unfounded and therefore dismissed (Section 144(2) of the Code of Administrative Court Procedure). The contested judgment is not based on a violation of federal law (Section 137(1) of the Code of Administrative Court Procedure).

17
The Higher Administrative Court held that the plaintiff cannot claim annulment of the final prohibition order of January 10, 2017, from the defendant by reopening the proceedings. In the absence of a change in the legal situation in favor of the plaintiff, there are no grounds for reopening the proceedings under Section 51 (1) No. 1, alternative 2, of the Saarland Administrative Procedure Act (SVwVfG). Since the purpose of the data processing pursued by the plaintiff violates Section 7 (2) No. 1 of the Act against Unfair Competition (UWG), there is no legitimate interest within the meaning of the authorization requirement under Article 6 (1) (f) GDPR. On these decisive points, the reasoning of the appeal judgment is consistent with reviewable law (Section 137 (1) Nos. 1 and 2 of the Administrative Procedure Act). Accordingly, the plaintiff's request for resumption of the administrative procedure due to a subsequent change in the legal situation is admissible (2.) according to the provision of Section 51 (1) No. 1 Alternative 2 of the Federal Administrative Procedure Act (VwVfG) (1.), which, according to its wording, corresponds to Section 51 (1) No. 1 Alternative 2 of the Federal Administrative Procedure Act (VwVfG), but is not justified (3.). The plaintiff is also not entitled to an error-free discretionary decision regarding the resumption of the procedure (in the broader sense) according to Section 51 (5) in conjunction with Sections 48 and 49 of the SVwVfG (4.).

18
1. The plaintiff's request for an order, which is the subject of the action and is aimed at reversing the defendant's final data protection order of January 10, 2017, is based on a request for reopening the administrative proceedings due to a subsequent change in the legal situation pursuant to Section 51 (1) No. 1, Alternative 2 of the Administrative Procedure Act (SVwVfG).

19
Although the plaintiff, in the letter from her legal representatives dated October 9, 2019, merely requested the annulment of the decision "pursuant to Sections 48 and 49 of the SVwVfG," according to the Higher Administrative Court's interpretation underlying the appeal judgment, the aforementioned letter is (also) a request for reopening the administrative proceedings pursuant to Section 51 (1) No. 1, Alternative 2 of the SVwVfG. This understanding is decisive. From an appeal law perspective, the interpretation of declarations of intent is an act of fact-finding, especially with regard to the understanding of the wording of the declaration and the review and clarification of the circumstances relevant to the meaning of the declaration. This also generally applies to applications filed in administrative proceedings (Federal Administrative Court, judgment of June 12, 2024 - 6 C 9.22 - NVwZ 2024, 1585 para. 44). In the absence of any procedural objections in this regard, the Senate is bound by the Higher Administrative Court's interpretation pursuant to Section 137 (2) of the Code of Administrative Court Procedure (VwGO). Furthermore, the Higher Administrative Court's interpretation of the application of October 9, 2019, is not objectionable in substance. In support of its application for annulment, the plaintiff argued that the legal situation applicable at the time the contested order was issued had changed due to the entry into force of the General Data Protection Regulation on May 25, 2018. Since the currently applicable law would preclude a renewed issuance of the contested order, the decision of January 10, 2017, should be annulled with future effect. The plaintiff thus clearly referred to the requirements for resuming administrative proceedings pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG). According to this provision, the authority must, upon application by the data subject, decide on the annulment or amendment of an unappealable administrative act if the legal situation underlying the administrative act has subsequently changed in favor of the data subject.

20
2. The admissibility requirements for the administrative act presented to the defendant as having been issued pursuant to Section 51 (4) SVwVfG i. The plaintiff's application for resumption of the administrative procedure pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG), submitted to the competent authority in accordance with Section 40 (1) BDSG and Article 58 GDPR, is met.

21
a) The plaintiff was unable, without gross negligence, to assert the grounds for resumption in the earlier proceedings, in particular by means of an appeal (Section 51 (2) SVwVfG), because in the court proceedings following the administrative proceedings, the legality of the contested data protection order depended on the legal situation applicable at the time of the (last) administrative decision in January 2017 (cf. Federal Administrative Court, judgment of March 27, 2019 - 6 C 2.18 - BVerwGE 165, 111 paras. 11 et seq.). In view of this, the Higher Administrative Court, in its decision of September 10, 2019 - 2 A 174/18 - rejecting the plaintiff's application for leave to appeal against the Administrative Court's judgment of March 9, 2018 - 1 K 257/17 - dismissing the action, rejected the assessment already requested by the plaintiff in the then legal proceedings against the defendant's decision of January 10, 2017, based on the standard of the General Data Protection Regulation, which became applicable on May 25, 2018.

22
b) The plaintiff's application for resumption of the proceedings, filed on October 9, 2019, complied with the statutory three-month period, which generally begins on the day on which the data subject became aware of the reason for resumption (Section 51 (3) of the Administrative Procedure Act). Since the application under Section 51 (1) of the Administrative Procedure Act (SVwVfG) presupposes the finality of the original administrative act, the time limit here began to run with the Higher Administrative Court's decision of September 10, 2019, rejecting the plaintiff's application for leave to appeal against the Administrative Court's judgment of March 9, 2018, dismissing the action.

23
c) The admissibility of the application for retrial also requires that the asserted change in the legal situation underlying the administrative act can affect the legality of the administrative act. Such an impact generally only has a lasting effect on administrative acts, i.e., in the case of those whose effect, according to their meaning and purpose and the relevant substantive law, is inherently permanent (BVerwG, judgment of 28 February 1997 - 1 C 29.95 - BVerwGE 104, 115 <120>). The fact that data protection orders based on Section 38 (5) Sentence 1 of the Federal Data Protection Act (BDSG) (old version) are generally permanent is recognized in the Senate's case law (cf. BVerwG, judgment of 27 March 2019 - 6 C 2.18 - BVerwGE 165, 111 para. 10; decision of 9 July 2019 - 6 B 2.18 - NVwZ 2019, 1771 para. 14). The same applies to the prohibition order at issue here pursuant to Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version). The final decision of January 10, 2017, continues to prohibit the plaintiff from processing the contact details of dental practice owners for the purpose of telephone advertising without their consent.

24
d) Finally, the plaintiff's application for resumption of the proceedings pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG) is also not inadmissible due to a lack of sufficient substantiation of its arguments (see: Federal Administrative Court, judgment of June 23, 1987 - 9 C 251.86 - BVerwGE 77, 323 <325>). The plaintiff essentially relied on the fact that, unlike the provisions of the Federal Data Protection Act in its then-current version, which were still applicable when the decision of January 10, 2017, Article 6 (1) (f) GDPR, which has been in force since May 25, 2018, provides for a flexible balancing of the legitimate interests of the controller and the interests of the data subject. The Senate has already previously pointed out that the regulatory concepts of the General Data Protection Regulation, which aims to harmonize data protection law within the European Union, can fundamentally deviate from the previous data protection provisions of the Member States (BVerwG, judgment of March 27, 2019 - 6 C 2.18 - BVerwGE 165, 111 para. 37). The fact that the balancing of interests pursuant to Article 6 (1) (f) GDPR Against this background, the possibility that Article 1(1)(f) GDPR may lead to a result more favourable to the plaintiff does not appear to be ruled out from the outset.

25
3. However, the plaintiff's request for reopening the proceedings is unfounded. The grounds for reopening the proceedings asserted in the request pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG), which defines and limits the subject matter of administrative and judicial review (cf. Federal Administrative Court, judgments of November 20, 2018 - 1 C 23.17 - BVerwGE 163, 370 para. 12 and of January 26, 2021 - 1 C 1.20 - Buchholz 316 Section 51 VwVfG No. 66 para. 20; decision of December 11, 1989 - 9 B 320.89 - Buchholz 316 Section 51 VwVfG No. 24), do not exist. Although the legal situation underlying the administrative act has subsequently changed (a)), this change does not benefit the plaintiff (b)).

26
a) Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (SVwVfG) requires that the legal norms governing the administrative act, i.e., its legal basis relevant to the decision, are subsequently amended (Federal Administrative Court, judgments of May 8, 2002 - 7 C 18.01 - Buchholz 428 Section 2 VermG No. 66 p. 68 and of September 4, 2007 - 1 C 21.07 - BVerwGE 129, 243 para. 14). This requirement is met here, as the data processing practiced by the plaintiff is no longer subject to the provisions of Section 4 (1), Section 28 (3) and Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version) applicable at the time the decision of January 10, 2017, was issued (aa)), but rather to those of the General Data Protection Regulation (bb)), which differ in several respects from those of the Federal Data Protection Act (BDSG) (old version) (cc)).

27
aa) The decision of January 10, 2017, is based on the provisions of Section 4 (1), Section 28 (3) and Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version). According to Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version), F. the supervisory authority could prohibit the collection, processing or use or the use of individual procedures in the event of serious violations or deficiencies, in particular those which posed a particular risk to personal rights, if the violations or deficiencies were not remedied within a reasonable time despite the order pursuant to Section 38 Paragraph 5 Sentence 1 BDSG (old version) and the imposition of a coercive fine. According to Section 4 Paragraph 1 BDSG (old version), the collection, processing and use of personal data was only permissible if this law or another legal provision permitted or ordered it or if the data subject had consented. Section 28 Paragraph 3 Sentence 1 BDSG (old version) essentially stipulated that the processing or use of personal data for the purposes of address trading or advertising was permissible if the data subject had consented. According to Section 28 Paragraph 3 Sentence 2 No. 1 BDSG (old version). F. the processing or use of personal data was also permissible insofar as it concerned list or otherwise summarized data about members of a group of people, which was limited to the data subject’s affiliation to this group of people, their job, industry or business title, their name, title, academic degree, address and year of birth, and the processing or use was necessary for the purposes of advertising the controller’s own offers, which the controller had collected from the data subject this data with the exception of the information on group affiliation in accordance with paragraph 1 sentence 1 number 1 of the provision or from generally accessible address, telephone number, industry or similar directories. For purposes pursuant to Section 28 Paragraph 3 Sentence 2 No. 1 BDSG (old version), the controller was permitted to store further data in addition to the data mentioned there in accordance with Section 28 Paragraph 3 Sentence 3 BDSG (old version). Section 28 Paragraph 3 Sentence 6 BDSG (old version) F. determined that processing or use under Section 28 (3) Sentences 1 to 4 of the Federal Data Protection Act (BDSG) (old version) was only permissible if the legitimate interests of the data subject were not conflicting.

28
bb) The Federal Data Protection Act, in the version applicable upon issuance of the administrative act of January 10, 2017, which has become final and binding, expired on May 25, 2018, pursuant to Article 8 (1) Sentence 2 of the Act Adapting Data Protection Law to Regulation (EU) 2016/679 and Implementing Directive (EU) 2016/680 (EU Data Protection Adaptation and Implementation Act - DSAnpUG-EU) of June 30, 2017 (Federal Law Gazette I p. 2097). From this date, the General Data Protection Regulation (Article 99(2) GDPR in conjunction with Article 288(2) sentences 1 and 2 TFEU) applies directly.

29
The fact that the General Data Protection Regulation is now fundamentally applicable to the data processing practiced by the plaintiff for the described purpose of contacting dentists by telephone is not called into question by Article 95 GDPR. Accordingly, the General Data Protection Regulation does not impose any additional obligations on natural or legal persons with regard to processing in connection with the provision of publicly available electronic communications services in public communications networks within the Union, insofar as they are subject to specific obligations laid down in Directive 2002/58/EC that pursue the same objective. According to its clear wording, Article 95 GDPR does not lead to a general displacement of the General Data Protection Regulation within the scope of Directive 2002/58/EC, but rather regulates the delimitation of the scope of application of the Regulation and the Directive in the event of a conflict. This conflict only arises if both legal acts contain competing obligations pursuing the same objective (see Federal Court of Justice, judgment of May 28, 2020 - I ZR 7/16 - NJW 2020, 2540, para. 59). Whether the provisions of Directive 2002/58/EC take precedence cannot therefore be assessed uniformly, but only with regard to specifically regulated obligations.

30
cc) The provisions of the General Data Protection Regulation now applicable to the data processing practiced by the plaintiff differ from the provisions of the Federal Data Protection Act in the version applicable at the time the decision of January 10, 2017, was issued, both in terms of the facts ((1)) and the legal consequences ((2)).

31
(1) Firstly, the relevant legal requirements for data processing in the present case are regulated in the General Data Protection Regulation in a manner that deviates from the previous version of the Federal Data Protection Act. A specific regulation comparable to Section 28 (3) of the Federal Data Protection Act (BDSG) (old version) regarding the processing of personal data for advertising purposes is missing in the General Data Protection Regulation. Rather, Article 6 (1) (1) GDPR now also applies to these processing purposes. This provision contains an exhaustive and final list of cases in which the processing of personal data may be considered lawful (CJEU, judgments of 4 July 2023 - C-252/21 [ECLI:​​EU:​​C:​​2023:​​537], Meta Platforms and Others <General terms and conditions of use of a social network> - ‌paragraph 90, of 12 September 2024 - C-17 and 18/22 [ECLI:​​EU:​​C:​​2024:​​738], HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG - para. 34 and of 4 October 2024 - C-200/23 [ECLI:​​EU:​​C:​​2024:​​827], Agentsia po vpisvaniyata - para. 94). If the data subjects have not legally consented to the processing of their personal data (Article 6 (1) subparagraph 1 letter a in conjunction with Article 4 No. 11 GDPR), processing operations are only lawful if they can be based on at least one of the legal grounds under Article 6 (1) subparagraph 1 letters b to f GDPR. In the present context of data processing for the purpose of telephone advertising, only Article 6 (1) subparagraph 1 letter f GDPR can be considered as a legal ground in addition to consent (Article 6 (1) subparagraph 1 letter a GDPR). According to this, processing must be necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data prevail.

32
The legal grounds under Article 6 (1) subparagraph 1 letter a GDPR The Court of Justice of the European Union (CJEU) has further specified the review program resulting from Article 1(1)(f) GDPR in its case law. According to this, the processing of personal data is lawful under three cumulative conditions: First, a legitimate interest must be pursued by the controller or a third party; second, the processing of the personal data must be necessary to achieve the legitimate interest; and third, the interests or fundamental rights and freedoms of the person whose data is to be protected must not override the interests. First, regarding the requirement of pursuing a "legitimate interest," in the absence of a definition of this term in the General Data Protection Regulation, it should be noted that a broad spectrum of interests can, in principle, be considered legitimate. Second, with regard to the requirement that the processing of personal data is necessary to pursue the legitimate interest pursued, this requires an examination of whether the legitimate interest in processing the data cannot reasonably be achieved just as effectively by other means that are less intrusive with the fundamental rights and freedoms of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. The requirement that the processing of personal data is necessary must be examined in conjunction with the so-called "data minimization" principle, enshrined in Article 5(1)(c) of the GDPR, which requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." Thirdly and finally, as regards the condition that the interests or fundamental freedoms and rights of the person whose data are to be protected do not override the legitimate interest of the controller or of a third party, the Court of Justice has held that that condition requires a balancing of the respective competing rights and interests, which depends, in principle, on the specific circumstances of the case and that it is therefore for the referring court to carry out that balancing in the light of those specific circumstances. Furthermore, according to Recital 47 of the GDPR, the interests and fundamental rights of the data subject may override the interests of the controller, in particular when personal data are processed in situations in which a data subject does not reasonably expect such processing (see ECJ, judgments of 4 July 2023 - C-252/21 - paras. 106 et seq., of 7 December 2023 - C-26 and 64/22 [ECLI:​​EU:​​C:​​2023:​​958], SCHUFA Holding <Restschuldbefreiung> - paras. 76 et seq. and of 12 September 2024 ‌- C-17 and 18/22 - paras. 49 et seq.).

33
(2) Secondly, the powers of the supervisory authority to remedy identified violations of law, now regulated in Article 58 (2) GDPR, differ from those under the previous legal situation. Unlike the general data protection clause of Section 38 (5) Sentence 1 of the Federal Data Protection Act (BDSG) (old version), which did not specify any specific remedial measures for the supervisory authorities, Article 58 (2) GDPR provides for a graduated catalogue of measures. Although the power granted to the supervisory authority by Article 58 (2) (f) GDPR to impose a temporary or final restriction on processing, including a ban, partially corresponds in terms of legal consequences to the power contained in Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version) to prohibit the collection, processing, use, or deployment of individual procedures. However, the respective powers mentioned are not identical because Section 38 (5) Sentence 2 of the Federal Data Protection Act (BDSG) (old version) is not identical. F. – as mentioned – was only applicable in cases of serious violations or deficiencies, in particular those associated with a particular threat to personal rights, and also required that violations or deficiencies were not remedied within a reasonable time, contrary to the order under Section 38 (5) Sentence 1 of the Federal Data Protection Act (BDSG) (old version) and despite the imposition of a coercive fine. Article 58 (2) (f) GDPR does not contain such requirements.

34
b) However, the application for resumption of the proceedings pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act is unfounded because the change in the legal situation described does not benefit the plaintiff.

35
aa) A change in the legal situation has a beneficial effect on the person affected – as required by Section 51 (1) No. 1, Alternative 2 of the Administrative Procedure Act – if the change in the legal norms relevant to the administrative act issued results in a decision more favorable to the person affected being necessary or at least possible (established case law, see Federal Administrative Court, judgments of August 17, 2011 - 6 C 9.10 - BVerwGE 140, 221 para. 55, of November 20, 2018 - 1 C 23.17 - BVerwGE 163, 370 para. 13, of August 13, 2020 - 1 C 23.19 - Buchholz 412.3 Section 15 of the Federal Administrative Court Act No. 41 para. 15, of January 26, 2021 - 1 C 1.20 - Buchholz 316 § 51 VwVfG No. 66 para. 24 and of April 20, 2023 - 1 C 4.22 - NVwZ-RR 2023, 1011 para. 16).

36
The possibility of a decision more favorable to the person concerned cannot be assumed in court proceedings – comparable in this respect to the standard of review for standing (Section 42 (2) VwGO) – if a decision more favorable to the person concerned is not obviously and unambiguously excluded from every perspective. Rather, in deciding on the merits of the application for reopening pursuant to Section 51(1) No. 1 Alternative 2 of the (S)VwVfG, the court must, in principle, conclusively examine whether the incontestable administrative act should be upheld on the basis of the new legal situation. Only in cases where the authority has discretion must it be sufficient for the application to reopen the proceedings to be well-founded that the possibility of exercising discretion in favor of the person concerned cannot be excluded (see Engels, in: Mann/​Sennekamp/​Uechtritz, VwVfG, 2nd ed. 2019, § 51 para. 30; Sachs, in: Stelkens/​Bonk/​Sachs, VwVfG, 10th ed. 2023, § 51 para. 92; Falkenbach, in: Bader/​Ronellenfitsch, BeckOK VwVfG, as of January 2025, § 51 para. 33). If, however, the discretion in the specific case is reduced to zero, this must also be taken into account not only in the context of a new decision on the merits, but already in the context of the merits of the application to reopen the proceedings.

37
The requirement for an unrestricted substantive review within the framework of the court's decision on the merits of the application for reopening pursuant to Section 51 (1) No. 1, Alternative 2 of the Administrative Procedure Act (VwVfG) is already evident in the wording of the law. This requires not only that the legal situation underlying the administrative act could have changed to the benefit of the person affected, but that it "has changed." This understanding also takes into account the principle of legal certainty. This requires that the breach of the validity and res judicata effected by Section 51 (1) No. 1, Alternative 2 of the Administrative Procedure Act (VwVfG) in the event of a change in the legal situation be limited to exceptional cases. Accordingly, with regard to the grounds for reopening the case, as regulated in Section 51 (1) No. 2 of the Administrative Procedure Act (VwVfG), of the existence of new evidence which would have led to a decision more favourable to the person concerned, the case law of the Federal Administrative Court has clarified that the admissibly asserted new evidence must be of such a nature that it undermines the correctness of the factual basis for the administrative act and leads to the firm conviction that the authority at the time proceeded from incorrect factual preconditions and, had it been aware of the true circumstances, would have decided in favour of the person concerned (BVerwG, judgments of 28 July 1989 - 7 C 78.88 - BVerwGE 82, 272 <277 et seq.> and of 20 April 2023 - 1 C 4.22 - NVwZ-RR 2023, 1011 para. 31; decisions of 29 October 1997 - 7 B 336.97 - VIZ 1998, 86 et seq., of 3 May 2000 - 8 B 352.99 - Buchholz 316 § 51 VwVfG No. 42 and of 26 January 2015 - 3 B 3.14 - Buchholz 310 § 132 para. 2 no. 3 VwGO No. 74, marginal no. 8).

38
Finally, the aspect of procedural economy also precludes a limited review of the facts within the framework of the court's decision on the merits of the application for reopening pursuant to § 51 para. 1 no. 1 alternative 2 VwVfG. If the application for reopening the proceedings is admissible and well-founded, the court must, in any case, due to its obligation to make the dispute fully ready for judgment within the meaning of Section 113 (5) Sentence 1 of the Administrative Procedure Code (VwGO), conduct the necessary examinations and findings itself and then make a final decision on the matter (established case law, see Federal Administrative Court, judgment of February 10, 1998 - 9 C 28.97 - BVerwGE 106, 171 <172> with further references). By bringing this comprehensive judicial review forward to the level of the decision as to whether the finality of the administrative act in question can be overturned by reopening the case pursuant to Section 51 of the Administrative Procedure Act, at least a partial duplication of review is avoided.

39
bb) The comprehensive judicial review of the merits of the application for reopening the proceedings pursuant to Section 51 (1) No. 1 Alternative 2 of the Administrative Procedure Act (VwVfG) leads to the conclusion that, even on the basis of the now applicable legal situation, no decision more favorable to the plaintiff can be considered. The plaintiff's claim against the defendant for annulment of the final decision of January 10, 2017, does not exist because the defendant would have to issue a decision of the same content even on the basis of the new legal situation.

40
As already explained, the only legal basis for prohibiting the plaintiff's data processing for the purpose of contacting dental practices by telephone with the aim of determining whether the persons contacted wish to sell precious metals to the plaintiff is now – exclusively – the directly applicable provision of Article 58 (2) (f) GDPR. Accordingly, the supervisory authority has remedial powers that allow it to impose a temporary or definitive restriction on processing, including a prohibition.

41
The defendant would also have to prohibit the plaintiff's conduct on the basis of the now applicable provisions of Article 6(1)(1)(f) and Article 58(2)(f) GDPR, as this constitutes a violation of the General Data Protection Regulation ((1)) and the defendant's discretion regarding the legal consequences, which is generally granted under Article 58(2) GDPR, is reduced due to the lack of other appropriate remedies ((2)).

42
(1) The plaintiff's conduct, which was prohibited by the defendant's final decision of January 10, 2017, based on the then-current version of the Federal Data Protection Act, violates the requirements of the now applicable General Data Protection Regulation. This is because the plaintiff processes personal data of the dentists concerned ((a)) without their consent ((b)). Contrary to the opinion of the lower court, the legal basis for processing under Article 6 (1) (f) GDPR is generally applicable here ((c)). However, when assessing whether the data processing is carried out to safeguard a "legitimate interest" within the meaning of this provision, the assessments of Section 7 (2) No. 1 of the Unfair Competition Act (UWG) must be taken into account ((d)), which are inconsistent with the purpose of the data processing pursued by the plaintiff ((e)).

43
(a) The names of the owners of dental practices, as well as the respective practice addresses and telephone numbers, which the plaintiff obtains from publicly accessible directories such as the Yellow Pages, constitute personal data within the meaning of Article 4 No. 1 GDPR. This is because it is information that relates to an identified or identifiable natural person – the data subject. The collection of the aforementioned data by the plaintiff, its storage in a database, and its use for contacting dental practices by telephone with the aim of finding out whether the persons contacted wish to sell precious metals to the plaintiff each constitute processing within the meaning of Art. 4 No. 2 GDPR by the plaintiff as the controller pursuant to Art. 4 No. 7 GDPR. The fact that the processing of the data is at least partially automated pursuant to Art. 2 Para. 1 GDPR is already clear from the fact that it is stored in a database. The data processing also clearly does not take place pursuant to Art. 2 Para. 2 Letter a GDPR in the context of an activity that does not fall within the scope of Union law, with the result that the General Data Protection Regulation would no longer apply in this respect. The applicant's actions must therefore be consistent with the principles for the processing of personal data laid down in Article 5 of the GDPR and, in view of the principle of lawfulness of processing provided for in Article 5(1)(a) of the GDPR, satisfy one of the conditions for lawfulness of processing listed in Article 6 of that Regulation (see ECJ, judgments of 20 October 2022 - C-77/21 [ECLI:​​EU:​​C:​​2022:​​805], Digi - paragraph 49 and of 7 December 2023 - C-634/21 [ECLI:​​EU:​​C:​​2023:​​957], SCHUFA Holding <Scoring> - paragraph 67).

44
(b) The plaintiff cannot base the processing of the personal data of the affected dental practice owners on Article 6(1)(a) GDPR. According to this provision, the processing of personal data is lawful if and to the extent that the data subject has given their consent for one or more specific purposes. According to the definition in Article 4(11) GDPR, "consent" of the data subject is any freely given, specific, informed, and unambiguous indication of the data subject's wishes in the form of a statement or other unambiguous affirmative action by which the data subject signifies agreement to the processing of personal data concerning them. The plaintiff has not asserted, and it is not apparent, that these requirements are met with regard to the dentists whose personal data the plaintiff processes.

45
(c) If the data subject has not given their consent to the processing of personal data concerning them pursuant to Article 6(1)(a) GDPR, the processing of personal data is lawful. If consent is not given voluntarily for the specific case, in an informed and unambiguous manner within the meaning of Art. 4 No. 11 GDPR, such processing is nevertheless justified if it meets one of the requirements of necessity set out in Art. 6 (1) (b) to (f) (cf. ECJ, judgment of October 4, 2024 - C-200/23 - para. 95 with further references). In principle, the legal basis for this is Art. 6 (1) (f) GDPR. Accordingly, processing is also lawful if it is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data prevail, in particular if the data subject is a child.

46
The general applicability of Article 6(1)(f) GDPR is not contradicted by the appeal judgment's assumption that the provision cannot be used as a legal basis for data processing for the purpose of telephone advertising because the opening clause in Article 13(3) of Directive 2002/58/EC, which permits Member State regulations prohibiting telephone advertising without the consent of the subscriber concerned, continues to apply. This legal opinion of the Higher Administrative Court violates reviewable law.

47
The only possible starting point for the primacy of Directive 2002/58/EC could be the aforementioned conflict of laws rule in Article 95 of the GDPR. This provision does not only concern cases of processing of personal data by a provider of publicly available electronic communications services via public communications networks for the purpose of providing those services, but also data processing by other persons, provided that this is carried out using an electronic communications service and is covered by the aforementioned directive (contrary to Karg, in: Simitis/​Hornung/​Spiecker gen. Döhmann, DatenschutzR, 2nd ed. 2025, Art. 95 GDPR paras. 1 and 4; Papakonstantinou/De Hert, in: Spiecker gen. Döhmann et al., General Data Protection Regulation, Art. 95 para. 9; Jandt, in: Jandt/​Steidle, Datenschutz und Internet, 2nd ed. 2025, II para. 69). Since this directive – as in its relevant Article 13 – also regulates obligations of persons other than the provider of publicly available electronic communications services over public communications networks, a restriction of the personal scope of application should at least have been implied in the wording of Article 95 GDPR. However, this is not the case. Rather, data processing is "related" to the provision of the communications service even if the person providing the electronic communications service and the person processing the data are different persons. This understanding is further supported by the fact that Article 95 GDPR echoes the wording of Article 3 of Directive 2002/58/EC, according to which this directive applies to the processing of personal data "in connection with the provision of publicly available electronic communications services on public communications networks."

48
However, Article 95 GDPR does not render the second subparagraph of Article 6(1) inapplicable in this case. 1(f) GDPR, because Article 13(3) of Directive 2002/58/EC does not constitute a provision in relation to which the General Data Protection Regulation imposes "additional obligations" on natural or legal persons. The opposite is the case: Article 13(3) of Directive 2002/58/EC contains stricter requirements with regard to unsolicited direct marketing communications than the General Data Protection Regulation. While the Regulation also lays down general rules in this regard, Article 13(3) of the Directive stipulates that Member States shall take appropriate measures to ensure, free of charge for subscribers, that, except in the cases referred to in paragraphs 1 and 2, unsolicited direct marketing communications which are either sent without the consent of the subscribers concerned or which are addressed to subscribers who do not wish to receive such communications are not permitted; the choice of these options is to be determined by national law. This regulatory mandate addressed to national legislators ultimately leads to an expansion of the controller's obligation to refrain from processing personal data without express consent. Article 6 (1) (f) GDPR and Article 13 (3) of Directive 2002/58/EC are therefore, in principle, applicable concurrently.

49
(d) However, the appeal judgment is not based on the stated violation of reviewable law (Section 137 (1) VwGO). The Higher Administrative Court independently and decisively relied on the fact that, when assessing whether data processing is carried out to safeguard a "legitimate interest" within the meaning of Article 6 (1) (f) GDPR, the assessments of Section 7 (2) No. 1 UWG must be taken into account. This reasoning is consistent with reviewable law.

50
The fundamental question of whether standards and assessments of national law may generally be applied when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR can remain open. Such a general consideration is contradicted by the fact that, according to the case law of the ECJ, Member States are not empowered to adopt supplementary provisions for the application of the conditions for lawfulness set out in Article 6(1)(a), (b), and (f) GDPR, since such a power is limited under Article 6(3) GDPR to the grounds set out in Article 6(1)(c) and (e) GDPR (ECJ, judgment of December 7, 2023 - C-634/21 - para. 69). Without a strict limitation of the Member States' regulatory powers, the objective of harmonizing law in the area of ​​personal data protection could be frustrated (see Opinion of Advocate General Pikamäe of 16 March 2023 - C-634/21 [ECLI:​​EU:​​C:​​2023:​​220], SCHUFA Holding <Scoring> - para. 69). With regard to Article 6(1)(f) GDPR, the ECJ has further clarified that Member States may not conclusively prescribe the outcome of the balancing of conflicting rights and interests (ECJ, judgment of 7 December 2023 - C-634/21 - para. 70).

51
On the other hand, the most recent case law of the ECJ provides strong evidence that, when assessing whether a legitimate interest within the meaning of Article 6(1)(f) GDPR is exercised, provisions of national law may also be taken into account. Thus, the ECJ has repeatedly considered it to be the responsibility of the referring court to assess the existence of such an interest in the individual case "taking into account the applicable legal framework" and all the circumstances of the case (ECJ, judgments of 12 September 2024 - C-17 and 18/22 - paras. 56 et seq. and of 4 October 2024 - C-621/22 [ECLI:​​EU:​​C:​​2024:​​858], Koninklijke Nederlandse Lawn Tennisbond - para. 49). From the respective context of the aforementioned decisions, it can be concluded that the ECJ considers the "applicable legal framework" to include national law. This suggests that standards and assessments of national law can be applied at least when specifying the legitimate interests within the meaning of Article 6(1)(f) GDPR, provided they do not have any data protection-specific content and thus do not pose a risk of circumventing the opening clauses provided for in the General Data Protection Regulation.

52
The fundamental question of whether provisions of national law are generally applicable, or at least when specifying the legitimate interests of the controller within the meaning of Article 6(1)(f) GDPR, is still unclear. 1 letter f GDPR may be used if the provisions are not specific to data protection, no decision is required here because the German legislator has implemented, with Section 7 of the UWG, the provisions contained in Article 13 of Directive 2002/58/EC to protect the privacy of data subjects from unsolicited advertising sent by electronic means (cf. BT-Drs. 15/1487 p. 15, 21; BGH, judgments of 16 July 2008 - VIII ZR 348/06 - BGHZ 177, 253 para. 30 and of 10 July 2018 - VI ZR 225/17 - BGHZ 219, 233 para. 12). It would therefore in any event be contrary to the principle of the unity of the Union legal order (see: ECJ, judgment of 10 September 2024 - C-351/22 [ECLI:​​EU:​​C:​​2024:​​723], Neves 77 Solutions SRL - para. 50 with regard to the system of legal protection under Union law), which also requires a coherent and consistent interpretation of different legal texts of secondary Union law, if these unfair competition law assessments of Article 13 of Directive 2002/58/EC, which is applicable in accordance with Article 95 GDPR alongside the General Data Protection Regulation, had to be disregarded when specifying the legitimate interest within the meaning of Article 6(1)(f) GDPR.

53
There is also a close link between data protection law and unfair competition law. The ECJ has held that a violation of a provision protecting personal data may simultaneously entail a violation of consumer protection rules or unfair commercial practices, and that, in order to safeguard fair competition, it may be necessary to take into account the provisions protecting personal data when enforcing competition law and the rules on unfair commercial practices (ECJ, judgment of 4 October 2024 - C-21/23 [ECLI:​​EU:​​C:​​2024:​​846], Lindenapotheke - paras. 55 et seq.). The coexistence of remedies under data protection law and competition law does not pose a threat to the uniform enforcement of the General Data Protection Regulation (ECJ, judgment of October 4, 2024 - C-21/23 - para. 67). In doing so, the ECJ primarily focuses on the practical effectiveness of the substantive provisions of the General Data Protection Regulation and its objective of ensuring a high level of protection for the right of every person to the protection of personal data concerning them (ECJ, judgment of October 4, 2024 - C-21/23 - paras. 62 et seq., 71).

54
(e) Based on this, the plaintiff lacks a legitimate interest within the meaning of Article 6(1)(f) GDPR because the purpose of the data processing pursued by it violates Section 7(2) No. 1 of the Unfair Competition Act (UWG).

55
According to Section 7 (1) Sentence 1 of the Unfair Competition Act (UWG), a commercial practice that unreasonably harasses a market participant is impermissible. According to Section 7 (1) Sentence 2 of the UWG, this applies in particular to advertising, even though it is evident that the market participant addressed does not want this advertising. Following on from this, Section 7 (2) No. 1 of the UWG stipulates that unreasonable harassment is always to be presumed when advertising is carried out by telephone to a consumer without their prior express consent or to another market participant without their at least presumed consent. The plaintiff's telephone contact with the owners of dental practices with the aim of determining whether the targets wished to sell precious metals to the plaintiff constitutes an impermissible commercial practice under these provisions. This is because the plaintiff's actions are to be qualified as advertising ((aa)), for which the presumed consent of the addressees of the advertisement, which is required for other market participants, is lacking ((bb)).

56
(aa) The telephone calls by which the plaintiff attempts to ascertain the willingness of the dentists called to sell precious metals are to be qualified as advertising within the meaning of Section 7 (2) No. 1 of the Unfair Competition Act (UWG). According to the case law of the Federal Court of Justice, which this Senate follows, the term "advertising" referred to in Section 7 (2) of the UWG generally also covers solicitation activities. This also applies if they are directed at traders or freelancers (Federal Court of Justice, judgment of December 15, 2015 - VI ZR 134/15 - NJW 2016, 870 paras. 9, 14). This follows from the purpose of Section 7 of the German Unfair Competition Act (UWG), which prohibits as unreasonable harassment those acts that are perceived as harassment simply because of their nature and manner, regardless of their content (cf. Bundestag Document 15/1487 p. 20). For the recipient's need for protection, it makes no difference whether they receive unsolicited offers to purchase goods or services or inquiries requesting such goods or services. The inclusion of requests directed at obtaining the goods or services a company needs for its own business activities on the market is consistent with an understanding of the concept of advertising that is oriented toward the goal of sales promotion (Federal Court of Justice, judgment of December 15, 2015 - VI ZR 134/15 - NJW 2016, 870 paras. 12 et seq.).

57
The fact emphasized by the plaintiff that the term "direct advertising" is used in Article 13 of Directive 2002/58/EC, which is implemented by Section 7 of the Unfair Competition Act (UWG), is irrelevant. According to the aforementioned case law of the Federal Court of Justice, direct advertising occurs when the advertiser establishes direct contact with a specific addressee, whether through personal contact, mail, or the use of telecommunications means such as telephone, fax, or email (Federal Court of Justice, judgment of December 15, 2015 - VI ZR 134/15 - NJW 2016, 870, para. 16). The fact that the content of the advertisement must be directed at the offer of goods or services, and that demand-led actions would therefore not be covered, cannot be inferred from the term "direct advertising."

58
(bb) Since the plaintiff's calls are directed to the owners of dental practices within the scope of their commercial or independent professional activities, they are not to be treated as consumers, for whom unreasonable harassment under Section 7 (2) No. 1 of the Unfair Competition Act would already be presumed in the absence of express consent. The Higher Administrative Court's dissenting opinion violates revisable law. Accordingly, Section 7 (2) No. 1 of the Unfair Competition Act should be interpreted "in accordance with the directive" in view of the fact that Article 13 (3) and (5) of Directive 2002/58/EC does not distinguish between the terms "consumer" and "other market participants," but only between natural and legal persons. However, it cannot be inferred from Article 13(3) and (5) of Directive 2002/58/EC that the protection to be guaranteed by the Member States against unsolicited messages for the purpose of direct marketing must be uniform for all natural persons. Union law only requires that, in principle, those natural persons who receive unsolicited telephone advertising not as consumers within the meaning of Section 2(2) of the Unfair Competition Act in conjunction with Section 13 of the German Civil Code (BGB), but in the course of their commercial or self-employed professional activity, are also protected. In this case, however, the requirement of presumed consent may also be sufficient, as Section 7(2) No. 1 of the Unfair Competition Act provides for other market participants. Since the assumption of presumed consent is excluded in any case in the event of an explicit objection by the recipient of the advertising, Section 7 (2) No. 1 of the Unfair Competition Act (UWG) fulfills the requirements of the second "option" referred to in Article 13 (3) of Directive 2002/58/EC, according to which unsolicited messages addressed to subscribers or users who do not wish to receive such messages must be prevented by appropriate measures taken by the Member States.

59
However, the plaintiff's telephone contact with the owners of dental practices is inadmissible because it lacks the presumed consent of the recipients of the advertising, which is required for other market participants under Section 7 (2) No. 1 of the UWG. Since the Higher Administrative Court also independently relied on this, the appeal judgment is not based on the established violation of law. According to the case law of the Federal Court of Justice, which the Senate follows and which the Higher Administrative Court also based its decision on, presumed consent requires that, based on specific factual circumstances, the caller can be presumed to have a legitimate interest in the telephone advertising. When assessing whether the caller can assume presumed consent from the businessperson being called, the circumstances prior to the call as well as the nature and content of the advertising must be taken into account. The decisive factor is whether the advertiser, upon reasonable assessment of the circumstances, could reasonably assume that the person being called was expecting such a call or would at least respond positively to it (Federal Court of Justice, judgments of September 20, 2007 - I ZR 88/05 - GRUR 2008, 189, paras. 14 et seq., and of March 11, 2010 - I ZR 27/08 - NJW 2010, 3239, paras. 20 et seq.). The presumed consent of the businessperson being called must extend not only to the content but also to the nature of the advertising. Accordingly, the trader being called must presumably (especially) agree to be contacted by telephone (Federal Court of Justice, judgments of January 24, 1991 - I ZR 133/89 - BGHZ 113, 282 <285>, of February 5, 2004 - I ZR 87/02 - GRUR 2004, 520 <521 et seq.>, and of March 11, 2010 - I ZR 27/08 - NJW 2010, 3239, para. 32).

60
Based on the criteria outlined above, the Higher Administrative Court held that such an objectively justified interest of dentists in the sale of precious metal residues to the plaintiff could not be established. The court held that an interest could not be inferred simply from the fact that the dentists called published their telephone numbers in publicly accessible directories, as this served solely to ensure accessibility for patients. The sale of precious metal residues for profit is neither typical nor essential to the work of a dentist. Moreover, the retention of precious metal residues in the possession of the dentist is likely to be the exception, as they are usually handed over to the patient concerned as their owner after dental treatment, who can dispose of them as they see fit.

61
The appeal court's assumption that a factual interest of the person called in the telephone advertising, indicating presumed consent within the meaning of Section 7 (2) No. 1 of the Unfair Competition Act, could not be presumed in this case, cannot be challenged by the appeal court. The assumptions underlying this legal assessment, namely that, on the one hand, the publication of dentists' telephone numbers in publicly accessible directories serves solely to ensure accessibility for patients and, on the other hand, that the sale of precious metal residues for profit is neither typical nor essential to the activity of a dentist, are factual findings to which the Senate is bound in the absence of any compelling procedural objections pursuant to Section 137(2) of the Code of Administrative Court Procedure. Therefore, the objections raised by the appeal on the law that the publication of contact details could pursue several purposes based on the profit-making intention of the respective dentist, that dentists regularly retain precious metals with the consent of their patients which could be recycled, and that the utilization of precious metal residues thus constitutes a typical activity of a dentist, are irrelevant.

62
(2) The plaintiff is also not entitled to a new decision on the merits because the defendant would have failed to exercise its discretion in relation to the legal situation now in force.

63
The General Data Protection Regulation does grant the supervisory authority discretion regarding the manner in which it remedies the identified deficiency, since Article 58(2) GDPR empowers the supervisory authority to take various remedial measures. It is incumbent on the supervisory authority to choose the appropriate and necessary means, taking into account all the circumstances of the specific case (see ECJ, judgments of 16 July 2020 ‌- C-311/18 [ECLI:​​EU:​​C:​​2020:​​559], Facebook Ireland and Schrems - para. 112, of 7 December 2023 - C-26 and 64/22 - para. 68 and of 26 September 2024 ‌- C-768/21 [ECLI:​​EU:​​C:​​2024:​​785], Land Hessen - para. 37). In doing so, it must take into account the need to ensure comprehensive compliance with the General Data Protection Regulation and to ensure a uniform and high level of protection for personal data through a clearly enforceable legal framework (ECJ, judgment of September 26, 2024 - C-768/21 - paras. 38 and 40).

64
However, the discretion generally granted to the supervisory authority is limited in the present case to the extent that the defendant must intervene and impose a ban on the processing of the personal data of dental practice owners without their consent for the purpose of telephone advertising pursuant to Article 58(2)(f) GDPR.

65
Failure by the defendant to intervene is clearly not an option in the present case. Although the supervisory authority may, exceptionally and taking into account the specific circumstances of the specific case, refrain from taking a remedial measure pursuant to Article 58(2) GDPR, provided that the situation giving rise to a breach of the General Data Protection Regulation has already been remedied, the processing of personal data by the controller is ensured in accordance with that Regulation, and such non-intervention by the supervisory authority is not likely to undermine the requirement for a clearly enforceable legal framework (ECJ, judgment of September 26, 2024 - C-768/21 - paras. 43 and 46). However, such an exceptional case clearly does not apply here. The plaintiff expressly intends to continue the data processing complained of by the defendant.

66
With regard to the selection of the specific remedial measure, the discretion generally granted to the supervisory authority under Article 58(2) GDPR is limited in the present case to the extent that only a prohibition pursuant to Article 58(2)(f) GDPR is appropriate, necessary, and proportionate to remedy the identified infringement of the General Data Protection Regulation. Given the nature of the infringement of the General Data Protection Regulation, the remedial powers referred to in Article 58(2)(c), (d), (e), (g), (h), and (j) GDPR are, a priori, irrelevant. The imposition of a fine referred to in Article 58(2)(i) GDPR is not a less intrusive measure than the prohibition based on Article 58(2)(f) GDPR. Furthermore, Article 58(2)(i) and Article 83(2)(1) GDPR clarify that a fine may be imposed not only instead of, but also in addition to, the other measures referred to in Article 58(2) GDPR. The plaintiff could not obtain a new decision on the application for reopening the proceedings by arguing that the authority failed to consider the possibility of a less favorable decision for the plaintiff in its discretionary considerations.

67
The remedy powers referred to in Article 58(2)(a) and (b) GDPR could, in principle, be considered as less intrusive alternatives to the prohibition. These powers empower the supervisory authority to warn a controller or processor that intended processing operations are likely to infringe the General Data Protection Regulation, or to issue a warning if processing operations have led to a breach of the provisions of this Regulation. However, in the case of the plaintiff's data processing for the purpose of telephone advertising without the express consent of the dentists called, neither a warning pursuant to Article 58 (2) (a) GDPR nor a reprimand pursuant to Article 58 (2) (b) GDPR can be considered appropriate remedial measures. Since the plaintiff - as explained - already lacks a legitimate interest within the meaning of Article 6 (1) (f) GDPR, it is clear that a design of the processing in question that complies with data protection law is not possible. The requirement to ensure a uniform and high level of protection for personal data through a clearly enforceable legal framework (cf. ECJ, judgment of September 26, 2024 - C-768/21 - paras. 38 and 40) can therefore only be adequately addressed by establishing an enforceable legal obligation for the plaintiff to cease the processing.

68
4. If, in light of all of the foregoing, the plaintiff has no claim against the defendant to annul the final decision of January 10, 2017, by way of resuming the proceedings pursuant to Section 51 (1) No. 1, Alternative 2 of the Administrative Procedure Act (SVwVfG), because the maintenance of the administrative act is lawful in light of the new legal situation, it is thus also clear that the Higher Administrative Court denied the plaintiff's further asserted claim for an error-free discretionary decision on resuming the proceedings (in the broader sense) pursuant to Section 51 (5) in conjunction with Sections 48 and 49 of the SVwVfG without violating reviewable law.

69
5. The decision on costs is based on Section 154 (2) of the Administrative Court Code (VwGO).