Hamburg regional court ruling from 22 February 2024 - 327 O 250/22

From Data Bytes 46 summarising updates from April 2024

On 22 February 2024, the Hamburg regional court ("LG Hamburg") ruled that platform op-erators may impose a mandatory account registration on users to the extent necessary for providing certain products and services.

In its Guidelines from 24 March 2022 the Conference of Independent Data Protection Su-pervisory Authorities of the Federation and the Länder ("DSK") held that mandatory cus-tomer accounts contravene GDPR provisions. According to these Guidelines, processing data in context of a customer account requires consent. This consent is not freely given if the customer must register for a customer account to acquire products or order services. Further, the DSK outlines that the retailers and platform operators cannot rely on the con-tract to purchase goods or services. At least at the time of the first order, the retailer cannot store data for uncertain future purchases. After the publication, authors have criticised the DSK for not considering the legitimate interest (Art. 6 para. 1 lit. f. GDPR) or the platform contract (Art. 6 para. 1 lit. b GDPR) as legal bases.

With its ruling, the LG Hamburg constitutes an exception to the strict DSK Guidance. With respect to the customer account of major platform operator in Germany, it held that the platform operator must retain the data processed in the customer account for accounting and tax purposes (purchase data) and has a legitimate interest (Art. 6 para. 1 lit. f GDPR) to process limited further data (account password). At least in the event the customer ac-count serves as the central information and communication platform between thousands of retailers, the platform operator has a legitimate interest to provide a mandatory customer account.

Authors: Alexander Duisberg, Partner; Andrea Mauroschat, Partner; Lisa Kopp, Junior Associate; David Plischka, Junior Associate