DECISION
11 LA 136/21
1 A 175/17
In the administrative law case
the woman xxx
– Plaintiff and respondent in the application for leave to appeal –
Legal representative:
Attorney Sven Adam,
Lange Geismarstraße 55, 37073 Göttingen
against
The State of Lower Saxony, represented by the Göttingen Police Directorate,
Groner Landstraße 51, 37081 Göttingen –
– Defendant and applicant for leave to appeal –
Regarding the collection and storage of personal data by the police
– application for leave to appeal –
The Higher Administrative Court of Lower Saxony – 11th Senate – decided on November 4, 2021:
The defendant's application for leave to appeal against the judgment of the Göttingen Administrative Court – 1st Chamber – of 12 May 2021 is rejected.
The defendant shall bear the costs of the admission procedure.
The value in dispute for the admission procedure is set at EUR 5,000.
REASONS
The defendant's application for leave to appeal against the judgment of the Administrative Court is unsuccessful.
In an email dated May 7, 2015, a police officer from the 4th Specialist Unit (State Security) of the Göttingen Police Inspectorate sent various observations and research results from the internet to other members of his specialist unit via a distribution list. Under the headings "LIMO", "AUMO" and "REMO", the email, among others, concerned the plaintiff and included the following:
"City center: 5:00 p.m. Ms. xxx with bicycle from the city to her apartment."
In her lawsuit filed on June 16, 2021, the plaintiff requested a ruling that
1. the collection and storage of personal data about her in the email of May 7, 2015 was/is unlawful,
2. the information provided by the Göttingen Police Directorate on April 12, 2017, regarding her data stored there, was incomplete and therefore unlawful.
In the contested judgment, the Administrative Court ruled on claim 1 that the storage of the plaintiff's personal data in the email to the distribution list in the specialist unit 4 – State Security – of the Göttingen Police Inspectorate of May 7, 2015 was unlawful, and otherwise dismissed the action.
The defendant's unrestricted application for leave to appeal against the judgment of the court of first instance is only partially admissible (see section 1 below). To the extent that the application for leave to appeal is admissible, it is unfounded. The grounds for appeal asserted by the defendant against the judgment of the court of first instance—namely, serious doubts as to the correctness of the decision pursuant to Section 124 Paragraph 2 No. 1 of the Code of Administrative Court Procedure (see section 2 below) and the fundamental importance of the case pursuant to Section 124 Paragraph 2 No. 3 of the Code of Administrative Court Procedure (see section 3 below)—are not sufficiently substantiated or do not exist.
1. Insofar as the Administrative Court dismissed the plaintiff's claim regarding her second claim, the defendant's application for leave to appeal is inadmissible. The defendant lacks the necessary standing to appeal in this respect (see, for example, W.-R. Schenke, in: Kopp/Schenke, VwGO, 27th ed. 2021, § 124a para. 38 and Introductory Note to § 124 paras. 28, 39 et seq. with further references; Happ, in: Eyermann, VwGO, 15th ed. 2019, Introductory Note to § 124 paras. 23 et seq., 28 et seq.). Insofar as the Administrative Court dismissed the plaintiff's claim, it granted the defendant's application and decided the legal dispute concerning the relevant legal relationship in his favor.
2. Furthermore, insofar as the Administrative Court found in the contested judgment that the storage of the plaintiff's personal data in the email to the distribution list of the specialist unit 4 – State Security – of the Göttingen Police Inspectorate dated May 7, 2015, was unlawful, the defendant's application for leave to appeal is unfounded. Serious doubts as to the correctness of the judgment pursuant to Section 124 Paragraph 2 No. 1 of the Code of Administrative Court Procedure have not been sufficiently demonstrated or do not exist in this respect.
Serious doubts as to the correctness of the judgment within the meaning of Section 124 Paragraph 2 No. 1 of the Code of Administrative Court Procedure (VwGO) exist if the appellant challenges a single, fundamental legal principle or a single, significant finding of fact with cogent counterarguments. The statement of grounds for appeal must address the reasons for the contested decision in a specific, case-related, and sufficiently substantiated manner, demonstrating that and why the administrative court incorrectly decided crucial legal and factual issues (see, for example, Roth, in: Posser/Wolff, BeckOK VwGO, as of January 1, 2021, Section 124a, marginal note 73 with further references). These doubts as to the correctness of the judgment must also relate to the outcome of the decision. It must therefore be sufficiently probable that the appeal will lead to a modification of the contested judgment (see Federal Administrative Court, Decision of March 10, 2004 – 7 AV 4/03 – juris para. 7 et seq.). Section 124 para. 2 no. 1 of the Code of Administrative Court Procedure thus only grants access to a substantive review of the contested decision in an appeal proceeding in cases where the correctness of the contested judgment requires further examination. In contrast, it is not sufficient if there are merely doubts about the correctness of individual legal principles or factual findings of the judgment, but the judgment is correct in its outcome (see Federal Administrative Court, Decision of March 10, 2004 – 7 AV 4/03 – juris para. 9 et seq.).
Based on this, the reasons put forward by the defendant do not give rise to any serious doubts about the correctness of the contested judgment.
The Administrative Court reasoned as follows in its judgment: The data storage was unlawful. A procedural description required under Section 8 of the Lower Saxony Data Protection Act (NDSG) in the version of January 29, 2002 (Lower Saxony Law Gazette, p. 22), as amended by Article 1 of the Act of December 12, 2012 (Lower Saxony Law Gazette, p. 589, note: valid until May 24, 2018, Article 26 sentence 2 of the Act of May 16, 2018, Lower Saxony Law Gazette, p. 66, hereinafter: old version), was completely lacking. The scope of application of the provision was met. Automated processing is the processing of personal data using data processing systems. Automated processing presupposes that, in addition to the collection or storage by technical systems, the automated evaluation of the data, i.e., the use of the data, is also enabled. Therefore, the possibility of technically evaluating the collected and stored data is required. A defining characteristic of an automated process is the processing of personal data for a specific purpose. According to this criterion, the transmission of situation reports via email to a distribution list within a police unit constitutes automated processing within the meaning of Section 8 Sentence 1 of the Lower Saxony Data Protection Act (NDSG aF), because although the data entry is manual, the storage and transmission are then automated and without human intervention. Emails can also be automatically analyzed using the search function. This function allows for searching not only for personal data in the sender and recipient information, but also within the text itself. At least in this practice within FK 4, personal data of individuals who have been the subject of observation by police officers are stored for a specific purpose, namely the transmission of situation reports. The use of the email program for this transmission differs from oral communication among colleagues or handing over notes due to the storage and search capabilities. Only this difference constitutes a process relevant under data protection law. In this specific case, the fact that, according to section 4.6 of the Lower Saxony Police's Information Security Guidelines, emails no longer necessary for fulfilling duties must be deleted does not change anything. The regulations regarding email usage found in the Information Security Guidelines do not meet the requirements for a procedural description. These measures are partly technical and partly organizational, as defined in Section 7 of the Lower Saxony Data Protection Act (NDSG aF). Furthermore, no exceptional case exists under Section 8, paragraph 1, sentence 2, clause 1 of the Lower Saxony Data Protection Act (NDSG aF).
To the extent that the defendant argues that the processing in question did not constitute automated data processing within the meaning of Section 8 Sentence 1 of the Lower Saxony Data Protection Act (NDSG) in its former version, and that the use of the distribution list merely enabled the sender of the email to send a message to all members of the distribution list simultaneously as a substitute for an oral meeting regarding the handover of duties, and that this was the extent of the automation, and that no automated evaluation of the personal data took place, he overlooks the fact that he himself refers elsewhere in his statement of grounds for appeal to the court of first instance to the fact that the decisive factor for the assumption of automated data processing is the possibility of technical evaluation of the data in question. The defendant has not demonstrated that – contrary to the assumption of the Administrative Court – this possibility did not exist, and moreover, this is not apparent to the Senate.
The Administrative Court addressed the defendant's further objection to the contested judgment that the data was not stored for more than a temporary period. It stated that, in accordance with the police's information security guidelines, the data in the email of May 7, 2015, was indeed stored only temporarily. However, its storage served the purpose of content analysis. The fact that this content analysis was not regularly automated (i.e., not using a search function) but simply carried out by reading the email was irrelevant. The defendant does not address these points. With his application for leave to appeal, he merely reiterates the Administrative Court's key reasoning against the application of an exception under Section 8 Paragraph 1 Sentence 2 Clause 1 of the Lower Saxony Data Protection Act (NDSG aF), arguing that the email served the purpose of disseminating information. According to this provision, the requirement to specify the procedure in a procedural description pursuant to Section 8 Paragraph 1 Sentence 1 of the NDSG aF does not apply if the data is stored only temporarily and for a purpose other than content analysis. The defendant has therefore presented no arguments against the correctness of this assumption by the Administrative Court.
The Administrative Court also addressed the defendant's argument, raised in his application for leave to appeal, that no automated evaluation had taken place. In the contested judgment, the Administrative Court stated that neither the wording of the regulation nor its legislative history implied a limitation of the concept of substantive evaluation to automated procedures. The defendant fails to address these considerations as well. Therefore, no serious doubts have been raised regarding the correctness of the Administrative Court's assessment in this respect either.
The defendant's objection that the data's further use or automated processing does not pose a threat to personal freedom does not lead to a different assessment. According to the reasoning in the contested judgment, the correctness of which is not seriously in doubt for the reasons stated, the requirement for a process description under Section 8 of the Lower Saxony Data Protection Act (NDSG aF) is triggered by the automated processing of personal data, which is already assumed when personal data is processed using data processing systems (Section 3 Paragraph 5 NDSG aF), and by a defined purpose (here: the transmission of situation reports). The defendant has not sufficiently demonstrated, nor is it otherwise apparent to the Senate, that the wording of the law requires an additional condition for a process description under Section 8 NDSG aF: further use (for external purposes) and/or technical evaluation of personal data processed automatically in this way.
Insofar as the defendant argues that it is still unclear in case law whether email programs such as Microsoft Outlook should also be considered automated processes, this in itself does not justify the assumption of serious doubts about the correctness of the contested judgment.
3. The fundamental importance of the legal matter pursuant to Section 124 Paragraph 2 No. 3 of the Administrative Court Procedure Act (VwGO) has not been sufficiently demonstrated.
A case is considered to have fundamental importance only if it raises a legal or factual question that is relevant to the decision in the appeal proceedings, amenable to clarification across different cases, and must be clarified in the interest of legal uniformity or the further development of the law. The application for leave to appeal must raise a specific question, demonstrate its relevance to the decision, and (at least) indicate the reason that justifies the existence of fundamental importance (W.-R. Schenke, in: Kopp/Schenke, VwGO, 27th ed. 2021, § 124 para. 10 with further references). Leave to appeal on the grounds of fundamental importance is not granted if the question, as raised in the application, does not arise in the appeal proceedings, nor if the question can be answered unambiguously based on the wording of the law or if it has been clarified in case law – particularly by the Federal Administrative Court or the deciding panel.
The defendant posed the question, "whether the use of email distribution lists necessitates a procedural description within the meaning of XXX." He failed to demonstrate that the question, as raised in the application, would arise in an appeal proceeding. It has neither been argued nor is it otherwise apparent that the question of whether the use of email distribution lists justifies the need for a procedural description was decisive for the Administrative Court. On page 10 of its judgment, the Administrative Court expressly left open the question of whether the use of email for internal communication within a public authority always constitutes automated processing of personal data within the meaning of Section 8 Sentence 1 of the Lower Saxony Data Protection Act (NDSG) in its former version. The Administrative Court did not differentiate between the use of email distribution lists and that of other entities.
The decision on costs is based on Section 154 Paragraph 2 of the Administrative Court Procedure Act (VwGO).
The determination of the value in dispute is based on Sections 47 Paragraphs 1 and 3, 52 Paragraph 2 of the Court Costs Act (GKG).
This decision is final and cannot be appealed (§§ 152 para. 1 VwGO, 68 para. 1 sentence 5, 66 para. 3 sentence 3 GKG).
