Regional Court of Schweinfurt, judgment of 23.12.2024, Ref. 21 O 588/24

In proceedings conducted by us before the Regional Court of Schweinfurt (Case No. 21 O 588/24), we were able to achieve an important success for our client’s data protection. The court obliged the defendant insurance company to arrange for the deletion of our client’s personal data passed on to an external service provider as part of the claims settlement process.

Background to the procedure

Following a traffic accident, our client’s insurance company had forwarded personal data – including the complete damage report – to an inspection service provider to check the repair costs. However, once the claim had been settled, there was no longer any reason to continue storing this data.

The ruling: Clear requirements for data deletion

The Regional Court of Schweinfurt clarified that, in accordance with Art. 17 para. 1 lit. a GDPR, personal data must be deleted as soon as it is no longer required for its original purpose. In this case, the review of the repair costs had been completed and the claims settlement was finished. Further storage of the data was therefore no longer justified.

The court emphasized that the insurance company, as the controller within the meaning of the GDPR, is obliged to work towards the deletion of the data by the external service provider. The fact that the data was originally passed on legitimately does not change the obligation to delete it once the purpose of processing no longer applies.

Significance for those affected

This ruling strengthens the rights of accident victims and insured persons. It shows that insurance companies and their service providers are not allowed to store personal data for as long as they like. Once the claims settlement has been completed, there is a right to the deletion of the data passed on.

If you discover after a traffic accident that your personal data is still being stored by third parties, even though the claim has long since been settled, please contact us. We will consistently enforce your data protection rights.

Extract

Regional Court Schweinfurt
Az.
21 O 588/24
IN THE NAME OF THE PEOPLE

In the legal dispute

[…]

the Regional Court Schweinfurt 2nd Civil Chamber by the presiding judge at the Regional Court […] as single judge on 23.12.2024 based on the oral hearing of 25.11.2024 issues the following order

Final judgment

[…]

Defendant 2) is ordered to arrange for the deletion of the data of the plaintiff and his vehicle that it passed on to […] GmbH in the context of the claims settlement of the traffic accident of 14.05.2024 that is the subject of the dispute.

With regard to […] the plaintiff’s application to order the defendant 2) to arrange for the deletion of the personal data of the plaintiff and his vehicle that it had passed on to informa HIS GmbH in the context of the claims settlement in dispute, the action was declared settled by mutual consent.

[…]

IV.
The plaintiff also has a claim against the second defendant that the latter should arrange for the deletion of the plaintiff’s personal data passed on to […] GmbH in the course of the claims settlement.

According to Art. 17 para. 1 letter a) DSGVO, personal data must be deleted as soon as they are no longer necessary for the purposes for which they were collected or otherwise processed. This is the case in particular where a review procedure underlying the collection or storage of data has been finally completed with regard to the recorded data (ECJ, NJW 2018, 767, 769). The deletion as such must be carried out by the “controller” within the meaning of Art. 4 No. 7 GDPR, whereby, however, in the event that a third party causes the (continuous) storage by a controller, this third party is obliged to intervene against the controller within the scope of a claim for injunctive relief (see OLG Frankfurt a.M. GRUR 2018, 1283, 1285).

Insofar as the defendant objects that this is not personal data, but rather data relating solely to the damaged vehicle, this is incorrect. It remains undisputed that the report of the […] expert office, which contains personal data of the plaintiff, was transmitted unredacted.

Based on this, the second defendant must work towards the deletion of the data relating to the plaintiff that was deposited with […] GmbH at its instigation.

With regard to the plaintiff’s data deposited with the testing institution Control€xpert GmbH, it is irrelevant at this point that the second defendant was entitled to pass on the expert opinion of […] Sachverständigenbüro including the plaintiff’s data for the purpose of checking the calculation as part of the claims settlement (see e.g. OLG Frankfurt a.M. DS 2019, 261, 262 with further references). In any case, the test assignment has been completed in the meantime, so that there is no longer any reason to continue storing the data. The repair damage was settled between the parties and is no longer the subject of these proceedings; the purpose for the further use of the plaintiff’s data at […] GmbH has thus ceased to exist, so that the second defendant must work towards the deletion of the plaintiff’s personal data there.
[…]

The value in dispute was determined on the basis of Sections 63 (2), 48 (1) GKG, 3 ZPO and takes into account € 1,000.00 for each of the deletion claims.

[…]