In its ruling of January 29, 2018 (case reference: 13 U 165/16), the Higher Regional Court of Frankfurt am Main ruled that the sale of address data was invalid due to the address holder’s lack of consent.
Therefore, there are no contractual claims between the contracting parties arising from the sale.
Sale of millions of addresses
In the proceedings before the Higher Regional Court of Frankfurt am Main, two parties were in dispute over the sale of address data.
The managing director of the plaintiff was previously the managing director of the debtor.
On the day of the opening of insolvency proceedings, the managing director purchased various internet domains from the insolvency administrator of the insolvent company, including the address data generated via these domains, for a total of EUR 15,000.
The data was handed over to the managing director on a USB stick.
However, the address data was still stored on two servers, which the insolvency administrator sold to a third company that also traded in address data.
This company used the millions of addresses to send advertising emails for the website “Sexpage.de”.
Managing director demands injunction and pro rata repayment of the purchase price
The managing director was now of the opinion that the address data he had acquired had lost two thirds of its value due to the dubious use for advertising on the “Sexpage.de” website.
He then demanded a pro rata repayment of the purchase price from the purchase contract as well as an injunction against further use of the address data.
OLG Frankfurt: Sale invalid
The regional court upheld the claim at first instance.
However, the judgment was overturned by the Higher Regional Court of Frankfurt am Main on appeal.
The sale of the address data was invalid due to the lack of consent of the address data owners.
There were therefore no contractual claims between the parties – neither the right to cease and desist nor a claim for repayment of the purchase price.
Sale of address data violates the BDSG
The contract violates the provisions of the BDSG.
The use of so-called personal data is only permitted if the data subject consents or the so-called list privilege applies.
This is because “a person’s name, postal address, telephone number and email address” constitute classic personal data.
According to the Frankfurt judges, the one-off sale of such data also falls under address trading in accordance with Section 28 para.
3 sentence 1 BDSG.
Furthermore, the list privilege only applies to aggregated data of members of a certain group of people; however, this was not the case here.
No consent of the address data owner
There was also no consent from the address data owner to justify the sale in this case.
The consent required by the BDSG is only effective if it is based on the free decision of the data subject and the data subject is informed of the intended purpose of the collection, processing or use and the consequences of refusing consent.
However, the company that collected the data had failed to specify the data concerned according to the categories of any data recipients or the purpose of the address trade.
Furthermore, in the opinion of the court, the contract fails because the contract systematically obliges the parties to engage in unfair, anti-competitive behavior.
The sending of advertising emails without consent constituted unreasonable harassment pursuant to Section 7 para.
2 No. 3 UWG.
Insofar as the insolvency administrator sued was unjustly enriched in the amount of the purchase price obtained, this alone did not justify a claim for repayment by the managing director.
Such a claim was already excluded because both contracting parties had previously intentionally violated the mandatory provisions of the BDSG.