LG Berlin - 15 O 472/22
| LG Berlin - 15 O 472/22 | |
|---|---|
 | |
| Court: | LG Berlin (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 25(2) GDPR Article 80(2) GDPR |
| Decided: | 25.03.2025 |
| Published: | |
| Parties: | Google Ireland Ltd |
| National Case Number/Name: | 15 O 472/22 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | LG Berlin II (in German) |
| Initial Contributor: | Le |
A court found that Google's sign up form does not give users the opportunity to provide voluntary and informed consent for personalised advertising. It also found that google by default retains personal data for longer than necessary, violating the data minimisation principle.
English Summary
Facts
The plaintiff is a nationwide umbrella organisation of consumer centres in Germany. It is a qualified organisation to bring collective redress actions according to german law. The defendant is Google Ireland Ltd, the provider of Google services in the EEA.
To use some of the services provided by the defendant, a ‘Google account’ is required. At the sign up process, after users have first entered personal data to create an account, they must choose between 2 "personalisation settings”, “express personalisation" or "manual personalisation".
“Express personalisation" consists of a 1 step page that permits personalised advertising and "manual personalisation" that consist of 5 steps that allow the user to select the personal data they want to share. When users log in to their Google account, after completing the registration process, they have the possibility to modify the duration of data storage and reduce it to 3 months.
In June 2022 the plaintiff sent the defendant an unsuccessful warning letter, arguing that with this sign up process for a Google account, the defendant violated Article 5(1)(a) and Article 6(1)(a) GDPR since there is a lack of a voluntary, transparent and informed consent for a specific purpose. More specifically;
a. The user does not have the option not to give consent in the case of "express personalisation" and that is also unaware that they have the option of not giving consent if they return to "manual personalisation".
b. In the context of "manual personalisation", the use of personal data in the "personalised advertising" area cannot be completely deselected, as the defendant processes the user's "general location" for advertising purposes.
c. There is no transparent list of the defendant's services for which consent is given and therefore lack of a specific purpose.
d. The design of the consent process is confusing and unclear, in particular the use of "personalisation" instead of "consent" to the use of data.
The defendant claimed that the design of its personalisation settings constitutes voluntary and informed consent.
In January 2023 the plaintiff brought an injunctive relief case before the Regional Court of Berlin II (LG Berlin II).
The Hamburg Commissioner for Data Protection and Freedom of Information, stated that the consent in not voluntary or informed, highlighting that the "personalisation" does not make it sufficiently clear that it is a consent to data processing, which is a so-called deceptive design pattern.
Holding
First, the court established that the plaintiff is authorised to conduct the proceedings under german law, (Section 8(3)(3) UWG and Section 3(1) UKIaG) and Article 80(2) GDPR.
The court held that it is not necessary to prove a specific violation or damage to an individual person. In this respect, it is sufficient that the rights of identifiable persons are potentially affected by the processing.
Contrary to the defendant’s opinion, it stated that the power to bring proceedings pursuant to Article 80(2) GDPR for non-mandated non-profit organisations also extends to cross-border data processing and is not limited to national matters, enabling the organisations to assert the rights of natural persons on their behalf in accordance with Article 77 GDPR.
Second, the court ruled that there is no voluntary and informed consent within the meaning of Article 6(1)(a) GDPR. There is a lack of voluntariness due to the lack of possibility to completely refuse consent to data processing. Also, the defendant does not give users clear and comprehensible information about the scope and purpose of the data processing, violating the principle of transparency (Article 5(1)(a) GDPR).
Third, the court found a violation of Article 25(2) GDPR because the defendant set a default setting to store personal data for more than three months and therefore the retention period is not limited to the absolute minimum necessary. The fact that the storage period can be shortened after consent has been given is irrelevant since Article 25(2) GDPR requires that users do not have to make any changes to the settings in order to achieve the most "data minimising" processing possible.
Lastly, the court ordered the defendant to pay the plaintiff €242,99 and to cease and desist from any further offenses, subject to a fine of up to €250,000 for each case of infringement, or imprisonment for up to six months.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Berlin II Regional Court - Regional Court for Civil Matters - Littenstraße 12–17, 10179 Berlin-Mitte City Map Tel.: +49 30 9023-0 Fax: +49 30 9023-2223 Tegeler Weg 17–21, 10589 Berlin-Charlottenburg City Map Tel.: +49 30 90188-0 Fax: +49 30 90188-518
