VERDICT
1 A 565/18
In the administrative law case
xxx,
– Plaintiff –
Legal representative:
Attorney Adam,
Lange Geismarstraße 55, 37073 Göttingen
against
State of Lower Saxony,
represented by the Göttingen Police Directorate,
Groner Landstraße 51, 37081 Göttingen – 22.3-12330-711/18 –
– Defendant –
due to police law (storage of personal data by the police)
The Administrative Court of Göttingen – 1st Chamber – rendered the following judgment on the oral hearing of April 30, 2021, through the President of the Administrative Court xxx as single judge:
It is determined that the storage of the plaintiff's data in the "PMK-links" database set up at the Göttingen Police Inspectorate, specifically in Specialist Unit 4 (State Security), was unlawful.
The defendant shall bear the costs of the proceedings.
The judgment is provisionally enforceable due to the costs.
The defendant may avert enforcement by providing security in the amount of the enforceable costs if the plaintiff does not provide security in the same amount before enforcement.
FACTS
The plaintiff seeks a declaration that the storage of his data in a database “PMK-links” (for “politically motivated crime left”) of the Göttingen police inspectorate is unlawful.
In August 2018, the 31-year-old plaintiff submitted an inquiry to the defendant regarding the data stored about him. On November 1, 2018, he received an overview of the eight incidents concerning him stored in the NIVADIS case management system from the years 2013 to 2017, as well as information that an electronic criminal file was being maintained on him, marked with the note "politically motivated offender – PMK-Links" (left-wing extremist). The deletion date was set for December 18, 2021. Furthermore, personal data was stored in the "PMK-links" database of the Göttingen Police Inspectorate. There were also entries in the Lower Saxony Police Information System (POLAS) of the State Criminal Police Office, for which data from NIVADIS had been transferred to the State Criminal Police Office. Finally, there were also entries in the defendant's own document management system, belonging to the data protection officer and Department 22.
The "Politically Motivated Crime" file was created in March 2017 at the Göttingen Police Inspectorate, Central Criminal Investigation Department, Specialist Unit 4 (State Security), on the orders of the then-head of Department 2 of the Göttingen Police Directorate and based on a procedural description pursuant to Section 8 of the Lower Saxony Data Protection Act (old version), which the head of Department 2 had signed. On her orders, the file was divided into individual categories in September 2018, including the category "PMK-links" (politically motivated crime - left-wing extremism), whereupon the original PMK file was deleted. A "File description pursuant to Section 46 of the Lower Saxony Public Safety and Order Act for inclusion in the register of processing activities pursuant to Article 30 GDPR" was prepared for the file on August 13, 2018 (BA 002, pp. 21 ff.), which was again signed by the then-head of Department 2.
According to point 4 of the "file description" dated August 13, 2018, the purpose of the storage is as follows:
"The database serves for the research and analysis of information for the investigation and prevention of crimes. The database is intended to collect and evaluate information gathered during investigations or other police data collection.".
The file allows
- the rapid retrieval of previously obtained information,
- the matching of incoming information to already known facts,
- the identification of relevant persons, groups of persons, institutions, objects and things,
- the recognition of interconnections/connections between persons, groups of persons, institutions, objects and things,
- the acquisition of insights for police and investigative tactics,
- The elimination of insignificant information and findings.
According to point 6, the “circle of those affected” is defined as follows:
“Persons whose storage is necessary and permissible for case processing in the proceedings:
- Accused persons in criminal investigations and, where applicable, persons affected in administrative offense proceedings,
- Persons who are not suspects, but for whom there are indications justifying the assumption that the processing is necessary for the investigation or prevention of criminal offenses, for the apprehension of persons wanted for arrest, or for averting a concrete imminent danger existing in a specific case,
- Persons for whom there are facts justifying the assumption that they will commit crimes in the future,
- Contact persons and accompanying persons of the above-mentioned persons,
- Whistleblowers, witnesses, victims, injured parties, complainants and other persons providing information.”
According to point 7, deletion is carried out in accordance with the provisions of Section 39a of the Lower Saxony Public Safety and Order Act (Nds. SOG). The maximum periods are those stipulated in Section 47 Paragraph 1 of the Lower Saxony Public Safety and Order Act (Nds. SOG) for the review of disposal requirements.
On May 18, 2017, the plaintiff's personal data was stored in the "PMK" file and subsequently transferred to the "PMK-links" file. The following data is stored about him (GA p. 33): surname, first name, date of birth, place of birth, residential address, and also "positive" in the POLAS and INPOL columns. PMK marker "LIMO", prior offenses see ELKA "x", reason "OWi: Spitting sticks", source "NIVADIS", file number "xxx", date of offense "May 18, 2017". There are no entries in the "violent" and "repeat offender" columns.
The plaintiff filed suit on November 7, 2018. He argues that no file description existed at the time his data was recorded because the file description dated March 13, 2017, had been deleted and the current description is dated August 13, 2018. He contends that the file description is clearly too broad and undefined with regard to the group of affected individuals. Any person could be the addressee of an entry for any matter known to the police.
The plaintiff requests
a ruling that the storage of his personal data in a database called “PMK-links” maintained by the police inspectorate was unlawful.
The defendant requests that
the action be dismissed.
She counters the plaintiff's arguments, stating that a file description existed at the time the plaintiff's data was stored. The file "PMK-links," which has existed since September 2018, is based on Section 31 Paragraph 2 of the Lower Saxony Public Safety and Order Act (now the Lower Saxony Public Safety and Order Act). The file description is not too broad or vague with regard to the group of affected parties. The listed group of affected parties is subject to assessment by the investigating agency. Data is not stored indiscriminately, but only for the defined purposes. This allows the group of affected parties to be determined.
By decision of 15 March 2021, the Chamber, after hearing the parties involved, transferred the legal dispute to the rapporteur as a single judge for a decision.
For further details of the facts and the legal arguments, reference is made to the contents of the court file, the minutes of the hearing of April 30, 2021 and the administrative files of the defendant, which were the subject of the oral proceedings.
REASONS FOR DECISION
The heading had to be corrected ex officio to reflect that the defendant in the declaratory action is not the Göttingen Police Directorate, but the State of Lower Saxony, which is represented by the Göttingen Police Directorate.
The declaratory action brought is admissible.
The storage of data gives rise to a legally enforceable relationship within the meaning of Section 43 Paragraph 1 of the German Code of Administrative Procedure (VwGO). Therefore, no action for performance, in particular no action for an order compelling the deletion of personal data, is available here, pursuant to Section 43 Paragraph 2 VwGO. The defendant's representative stated in the oral proceedings that the deletion of the plaintiff's data in the file "PMK-links" had been carried out in response to the request for information. This was established, even though the exact deletion date had not been recorded.
The prerequisites for a judgment on the merits are also met. In particular, the plaintiff has a legitimate interest in a declaratory judgment that the data storage in the aforementioned file was unlawful until the entry was deleted. Any legitimate interest worthy of protection, whether legal, economic, or non-material, is considered a legitimate interest in a declaratory judgment within the meaning of Section 43 Paragraph 1 of the Code of Administrative Court Procedure (VwGO). The decisive factor is that the judicial declaration appears suitable to improve the plaintiff's legal position in the aforementioned areas (established case law, see, for example, Federal Administrative Court, judgment of February 6, 1986 – 5 C 40.84 –, BVerwGE 74, 1, 4 and of October 25, 2017 – 6 C 46.16 –, juris para. 20). The legitimate interest in a declaratory judgment required for the action is not limited to the recognized categories of risk of recurrence, interest in rehabilitation, and the intention to pursue a claim for damages. The nature of the interference challenged in the lawsuit, particularly in areas protected by fundamental rights, combined with the right to effective legal protection guaranteed by Article 19 Paragraph 4 of the Basic Law, can also justify the recognition of a legitimate interest in a declaratory judgment if the direct burden caused by the serious administrative act is limited to a period of time during which a court decision is hardly obtainable (Federal Constitutional Court, Decision of February 4, 2005 – 2 BvR 308/04 –, juris, para. 19; Federal Administrative Court, Judgment of October 25, 2017 – 6 C 46.16 – BVerwGE 160, 169 para. 20; Decision of May 10, 2019 – 6 B 20.19 –, juris para. 10; Higher Administrative Court of Lower Saxony, Decision of October 18, 2019). – 11 LC 148/15 –, juris para. 43). This includes, in particular, declaratory judgments concerning police measures (Federal Administrative Court, Judgment of October 25, 2017 – 6 C 46.16 –, juris, para. 20). In the present case, a legitimate interest in a declaratory judgment arises at least on the grounds of effective and, as far as possible, comprehensive judicial protection under Article 19 Paragraph 4 of the Basic Law, because the claim for erasure is essentially futile. According to the case law of the Federal Administrative Court, which the single judge follows, the storage of personal data enables automated processing and further use. The increased risk associated with the technical possibilities of data processing corresponds to the fundamental right to privacy protection afforded by Article 2 Paragraph 1 in conjunction with Article 1 Paragraph 1 of the Basic Law. This is all the more true since the storage and processing of personal data constitutes infringements that are often not directly perceptible to the individuals concerned and whose impact on their freedom often only becomes apparent indirectly or later in conjunction with other measures (Federal Administrative Court, Decision of 20 December 2017 – 6 B 14.17 –, juris para. 14 with reference to Federal Constitutional Court, Judgment of 24 April 2013 – 1 BvR 1215/07 –, BVerfGE 133, 277 para. 207).
The lawsuit is also successful on the merits. The storage of the plaintiff's data in the "PMK-links" database of FK 4 at the Göttingen Police Inspectorate at the time immediately before its deletion was unlawful.
In declaratory judgment actions, the relevant point in time for assessing the factual and legal situation is determined by the claim and the statement of grounds, in which the plaintiff specifies the point in time at which the existence or non-existence of the legal relationship is to be established (Happ, in: Eyermann, VwGO, 15th ed. 2019, § 43 para. 18). In this case, that is the point in time immediately before the deletion of the data. Since the data must still have existed at the time the information was provided by the decision of November 1, 2018, as otherwise no information would have been provided, and since the extract concerning the plaintiff was also submitted to the court file with the pleading of April 8, 2019, the single judge assumes that the data was deleted after April 8, 2019, and in close temporal proximity to that date. The relevant provisions are therefore those of the Lower Saxony Data Protection Act of 16 May 2018 (Lower Saxony Law Gazette 2018, p. 66) – NDSG – and the Lower Saxony Police and Public Order Act (NPOG, formerly Lower Saxony SOG, heading amended by Article 1 of the Act of 20 May 2019, Lower Saxony Law Gazette p. 88) in the version of 19 January 2005 (Lower Saxony Law Gazette p. 9), most recently amended by Article 2 of the Act of 6 April 2017 (Lower Saxony Law Gazette p. 106).
The legal basis for data storage in the file “PMK-links” is Section 23 Paragraph 1 Sentence 1 No. 1 NDSG in conjunction with Section 39 NPOG.
If data is collected for the purpose for which it was stored, the permissibility of the storage is governed by Section 38 Paragraph 1 Sentence 1 of the Lower Saxony Police and Public Order Act (NPOG) (see Lower Saxony Higher Administrative Court, Judgment of November 18, 2016 – 11 LC 148/15 –, juris, paragraphs 59 to 65 and principle 3). If data is to be stored for a purpose other than that for which it was originally collected, Section 39 NPOG applies, whereby Paragraph 1 Sentence 1 is the general provision and Paragraphs 2 to 5 regulate special cases, which in their respective areas of application take precedence over Paragraph 1 (see Beckermann, in: Saipa et al., Lower Saxony Police and Public Order Act, as of September 2020, 27th Supplement, Section 39 NPOG, paragraph 2). According to Section 39 Paragraph 1 Sentence 1 Number 1 of the Lower Saxony Police and Public Order Act (NPOG), the storage, modification, or use of personal data for purposes other than those specified in Section 38 Paragraph 1 NPOG is only permissible if the data is necessary for fulfilling another purpose of preventing danger and if it could have been collected for that purpose using the means or method by which it was collected. According to Section 39 Paragraph 3 Sentence 1 NPOG, the police may store, modify, or use personal data that they have lawfully collected or obtained in connection with the prosecution of criminal offenses concerning a suspect and, in connection therewith, concerning third parties, for purposes of preventing danger. According to Sentence 2 of the same provision, they may only store, modify, or use this data for the prevention of criminal offenses if this is necessary due to the nature, execution, or severity of the offense, as well as the personality of the suspect, to prevent comparable future offenses by that suspect.
Section 39 Paragraph 1 No. 1 of the Lower Saxony Police and Public Order Act (NPOG) is applicable to the storage of the plaintiff's data. This is because the purpose of storing the plaintiff's personal data in the "PMK-links" file is different from the purpose for which the defendant collected his personal data. As explained above, the plaintiff's data stored in the "PMK-links" file was collected against him in connection with administrative offense proceedings ("sticking a spit guard"), stored in NIVADIS, extracted from there, and stored in the database at issue. The file description/procedure description or the procedural directory is an essential source for determining the purpose of a police file (see Lower Saxony Higher Administrative Court, Judgment of November 18, 2016 – 11 LC 148/15 –, juris para. 54). The data is stored in the file not for the purpose of prosecuting the specific administrative offense, but, according to the "file description" dated August 13, 2018, which, according to the data protection officer of the Göttingen Police Directorate present at the oral hearing, was and still is part of the register of processing activities (§§ 23 para. 1 no. 1 NDSG, 38 NDSG), for the purpose of researching and analyzing information for the investigation and prevention of criminal offenses. The file is intended to collect and evaluate information generated during investigations or other police data collection. The special provisions of paragraphs 2 to 5 are not applicable to the present case; in particular, there is no case of data collection within the framework of criminal prosecution within the meaning of paragraph 3, because the triggering act in this specific case was not a criminal offense, but an administrative offense.
Pursuant to Section 39 Paragraph 1 Sentence 1 No. 1 of the Lower Saxony Public Safety and Order Act (NPOG), the data storage was not necessary at the relevant time for fulfilling another purpose of preventing danger or prosecuting crime. Necessity is lacking if the purpose of the data collection has ceased to exist or can no longer be achieved (see Böhrenz/Siefken, Nds. SOG, 9th ed. 2014, Section 38 para. 5). The purpose of data collection ceases to exist if there is no risk of repetition (cf. regarding data storage for criminal offenses, Federal Administrative Court, Decision of November 12, 1992 – 1 B 164.92 –, juris; Lower Saxony Higher Administrative Court, Judgment of November 18, 2016 – 11 LC 148/15 –, juris, para. 66 with reference to Federal Constitutional Court, Decision of May 16, 2002 – 1 BvR 2257/01 –, NJW 2002, 3231 et seq., juris, para. 15). Here, there are already well-founded doubts as to the necessity of storing the plaintiff's data, because, according to the defendant's submissions, it was deleted in response to his request for information, or at least under the influence of the court proceedings. The defendant's representative nevertheless refused to acknowledge the claim and maintained the necessity of the data collection. Such necessity arises neither from the purpose of the "PMK-links" database, nor from the plaintiff's specific entry, nor from any other circumstances known to the court. The "file description" of August 13, 2018, refers in section 4 to the purpose of investigating and preventing criminal offenses. However, the plaintiff was not entered into the database for such an offense, but rather for an administrative offense. While these are mentioned in section 6, "Group of Affected Parties," which states that "affected parties may be recorded within the framework of administrative offense proceedings," the "file description" does not specify under what circumstances this could be "necessary and permissible" (section 6 of the file description), especially since there is no reference anywhere in the text to the area of left-wing motivated crime that gave the database its name. Such a connection would have been required, at least with regard to those affected by administrative offense proceedings, including the plaintiff, who were only to be recorded "if applicable." The plaintiff's specific entry also provides no further indication of a possible future commission of left-wing motivated offenses by the plaintiff. Since the court is aware that only entries concerning the plaintiff in NIVADIS as of November 2018 have been made public, this also provides no information regarding the date of deletion. Up to that point, only a single offense committed by the plaintiff for shoplifting (date of offense: March 23, 2016) is recorded in NIVADIS; no political connection is apparent. Furthermore, according to the entries, the plaintiff was active in the so-called "left-wing scene"; for example, on July 14, 2015, he took photos of a fraternity house and was pushed off his bicycle by two members of the fraternity. On January 5, 2015, he participated in a sit-in protest by counter-demonstrators during a right-wing rally in Bad Nenndorf. He was also responsible for a graffiti workshop on July 31, 2017, organized by BASTA – Solidarische Jugend Northeim (Solidarity Youth Northeim), which resulted in a meeting with the police. Due to the lack of specific or limiting information in the "file description," no conclusions can be drawn regarding the purpose of the database.
Since the data storage already failed to meet the requirements of Section 39 Paragraph 1 No. 1 NPOG, it can remain open whether it was also unlawful because the "file description" was faulty (regarding this standard, see Lower Saxony Higher Administrative Court, Judgment of November 18, 2016, loc. cit., para. 51), for example because it was indeterminate at the time the plaintiff's data was deleted – as the plaintiff's representative argues – or because it violated the data protection principle of data minimization, or because, contrary to Section 46 NPOG, it was not signed by the then Chief of Police, but by the Head of Department 2.
The decision on costs is based on Section 154 Paragraph 1 of the Administrative Court Procedure Act (VwGO). The decision on provisional enforceability is based on Section 167 of the Administrative Court Procedure Act (VwGO) in conjunction with Sections 708 No. 11 and 711 of the Code of Civil Procedure (ZPO).
The following is information on legal remedies.
