Skip to content
Case Law · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

VG Düsseldorf - 29 K 3490/24

GDPRhub
Summary

Facts — District K., acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, it shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that District K. had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that District K. had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. District K.'s data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. LDI NRW initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from District K.'s administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that District K. had breached its GDPR accountability obligations. LDI NRW rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that LDI NRW had failed to adequately investigate the complaint because it had not obtained District K.'s administrative file before reaching its decision. Holding — The court held that Articles 57(1)(f) and 77(1) GDPR give rise to an enforceable right requiring a supervisory authority to investigate a complaint to the extent appropriate in the circumstances before determining whether a GDPR infringement has occurred. Recital 141 GDPR requires the investigation to extend as far as is appropriate in light of the circumstances of the individual case, including the significance of the complaint and the seriousness of the alleged infringement. Applying these principles, the court held that LDI NRW had adequately investigated the complaint. It had considered each allegation together with the detailed response provided by District K.'s data protection officer, invited the data subjects to provide any additional factual information, and explained that it would obtain extracts from the administrative file if concrete indications emerged that further relevant facts required clarification. As the data subjects did not provide any additional facts and there were no objective indications that the information already available was inaccurate or incomplete, the court held that LDI NRW was not required to obtain District K.'s administrative file or undertake further investigations in the absence of concrete indications that additional factual clarification was necessary. The court further held that LDI NRW had correctly concluded that no GDPR infringement had occurred. The court held that the disputed processing was lawful under Article 6(1)(e) GDPR, read together with Article 6(3) GDPR and § 88 of the German Water Resources Act (WHG), which provided the legal basis for the processing. The court also held that the transmission of personal data by email did not infringe Article 5(1)(f) GDPR because, in the circumstances of the case, transport encryption provided an appropriate level of security.

How it connects

Full text

Administrative Court Düsseldorf, Judgment of June 22, 2026 - 29 K 3490/24 Source: openJur 2026, 7056 Rkr: Official Collection: 1. On the appropriate scope of the investigation of a complaint by the supervisory authority within the meaning of Article 57(1)(f) GDPR. 2. If there are no concrete indications that further clarification of the facts is necessary, the supervisory authority is not required to initiate speculative investigations, even at the request of the complainants. 3. Section 88 of the German Water Resources Act (WHG) contains, specifically for water management law, the necessary legal basis for the collection, processing, and use of personal data. Judgment 1. The action is dismissed. 2. The plaintiffs shall bear the costs of the proceedings. 3. The judgment is provisionally enforceable with respect to costs. The plaintiffs may avert enforcement by providing security in the amount of 110% of the amount to be enforced, unless the defendant provides security in the amount of 110% of the amount to be enforced before enforcement proceedings commence. Facts 4 The subject of the present proceedings is a data protection complaint filed by the plaintiffs against the District of K. with the defendant supervisory authority on October 2, 2023. 5 The complaint is based on the following facts: On January 5, 2023, the District of K., during an aerial survey, determined that the bank of two properties along the D. Mühlenbach stream had been reinforced and a private jetty had been constructed. Neither the required permit for the bank reinforcement nor for the jetty was in place. One of the properties is owned by Gelsenwasser AG. The other property is owned by the City of L. am See and is leased to the plaintiffs. Subsequently, the K. district initiated administrative proceedings to determine how to deal with the unauthorized shoreline structures. 6 By letter dated September 29, 2023, the plaintiffs complained to the defendant about what they considered to be multiple data protection violations by Department 70 of the K. district concerning the case with file number FD 70: 66.32. -A5/2020- 1/2023. On page 9 of the file, it was demonstrably shown that three uninvolved individuals had been contacted. This email indicated that telephone conversations had also taken place. Furthermore, the question arose as to whether the emails had even been encrypted. On page 11 of the file, an email to Gelsenwasser, an uninvolved public limited company, was written and sent with 20 attachments. On page 25, a telephone conversation with Ms. C. was recorded. This person is unknown to them. On page 27, there is another email to Gelsenwasser as well as to two other people unknown to them. On pages 38-39, a letter from a lawyer dated April 28, 2023, without power of attorney, is visible. They never retained this lawyer. Nevertheless, the K. district communicates with the lawyer by telephone and discusses the entire matter. During the site visit on March 27, 2023, several uninvolved persons entered their property without their knowledge or consent. 7 Attached to the complaint was the statement from the K. district's data protection officer dated September 19, 2023, in response to the plaintiffs' complaint. He explained: After the determination of the shoreline reinforcement and the jetty, the initial focus was on identifying all potential sources of the disturbance. As owners, both the city of L. on the lake and Gelsenwasser itself are directly affected. Gelsenwasser is also the entity responsible for the water supply. The individuals contacted were employees of the Lower Nature Conservation Authority of the district and an employee of the Civil Engineering Office of the city of L. am See. Gelsenwasser, as the owner of the property, was informed because a bank reinforcement and a shelter are located on it. The telephone conversation with Ms. C. involved an obvious error in the name given. Based on the file note, it can be assumed that the person in question was the plaintiff. The individuals contacted by further email were employees of Gelsenwasser and the city of L. am See, who, as owners, are directly affected. The attorney contacted the named case officers by letter dated April 28, 2023, citing the exact official file number, and indicated that he represents the plaintiff. He assured them he would submit a power of attorney and requested access to the files. The site visit with representatives of the city, the Lower Nature Conservation Authority, and the Lower Water Authority had been announced to the plaintiffs in writing. At the site, all participating persons introduced themselves to the plaintiffs by name and their respective positions. 8 In response to an initial letter from the defendant dated December 19, 2023, stating that it could not identify any data protection violations, the plaintiffs objected on January 3, 2024, that the defendant could not form an objective opinion about the events without any access to the administrative files of the K. district. The unencrypted transmission of personal data via email alone was unlawful. At the same time, they announced a detailed statement should the defendant request access to the files. By letter dated January 20, 2024, the defendant requested further information from the plaintiffs regarding the facts of the case, should this be the subject of the announced statement. In their reply dated February 10, 2024, the plaintiffs then listed the data protection accountability obligations that, in their opinion, Department 70 of the K. district had violated. 9 By decision dated April 12, 2024, the defendant informed the plaintiffs that, after completing its review of the complaint of October 2, 2023, no data protection violation could be established. The defendant explained that, in four of the contested transfers of personal data, the K. district or the acting Department 70 had the necessary authorization. No data protection violation could be proven in the transfer of data to Ms. "R." Water law measures concerning the shoreline facility could be directed against the owner and the possessor of the facility. The plaintiffs, the City of L. am See, and Gelsenwasser AG would all have been potential addressees of an administrative act. In administrative proceedings that may infringe upon the rights of others, there is no general right of participants to have their personal data kept confidential from the other participants. This assessment consequently also applies to participation in an on-site inspection that serves the purpose of gathering evidence. The Lower Nature Conservation Authority must be informed of measures that may affect nature conservation interests. The significant alteration of riverbanks affects nature conservation interests. The technical transmission method via email is not objectionable. There is no indication of a high risk that would have required end-to-end encryption. For the K. district, there was no reason to doubt the attorney's authorization. He is bound by professional regulations not to make false statements. He was therefore entitled to be treated as an authorized representative. Regarding the conversation with Ms. "R.", it will not be possible to clarify who this person is. The identity cannot be clarified by consulting the telephone record. The defendant is only required to review the subject matter of a data protection complaint to a reasonable extent. 10 The plaintiffs filed a lawsuit against this decision on May 9, 2024, elaborating on their previous submissions and further asserting: The defendant's letters incorrectly identify their complaint with the wrong date. The defendant failed to comply with their request to inspect the administrative file before making a decision. The defendant did not process their data protection complaint properly. The defendant's file is inconsistent. 11 The plaintiffs request that 12 the defendant, by setting aside its decision of April 12, 2024, be ordered to reconsider the plaintiffs' complaint of September 29, 2023, taking into account the court's legal opinion. 13 The defendant requests that 14 the lawsuit be dismissed. 15 In support of its request, it refers essentially to its contested decision. 16 Insofar as the action was also directed against the District of K., the court severed the proceedings by order of June 6, 2024, and referred them to the competent Administrative Court of Gelsenkirchen. 17 The plaintiff was questioned about the facts of the case during the oral hearing. Reference is made to the minutes in this respect. 18 By letter dated June 23, 2026, the plaintiffs requested the reopening of the oral hearing. 19 For further details of the facts and the legal arguments, reference is made to the contents of the court file and the administrative records. Reasons 20 The court was able to decide on the action based on the oral hearing of June 22, 2026. The plaintiff's request of June 23, 2026, for the reopening of the oral hearing pursuant to Section 104 Paragraph 3 Sentence 2 of the Code of Administrative Court Procedure (VwGO), was not granted. The rejection of a motion to reopen the oral proceedings does not require a separate (preliminary) decision; it suffices if the decision not to reopen the oral proceedings is explained in the judgment itself. 21 Federal Administrative Court, Decision of January 25, 2016 - 2 B 34.14 - , juris para. 29. 22 There are no grounds that would require the reopening of the oral proceedings or that could reduce the court's discretion in this respect to zero. In particular, neither a violation of the right to be heard (Art. 103 para. 1 of the Basic Law, § 108 para. 2 of the Code of Administrative Court Procedure) nor a material deficiency in the investigation is apparent. The plaintiffs argue that the defendant admitted during the oral proceedings that not every single data flow had been reviewed. In doing so, the defendant itself confirmed that the complaint had not been examined in its entirety. This does not constitute a violation of the right to be heard, nor a lack of investigation. The question of whether the defendant adequately investigated the plaintiffs' complaint is, in fact, a purely legal question to be examined by the court. The relevant factual aspects, in particular the actual scope of the defendant's investigations, were the subject of the entire proceedings. No new facts relevant to the decision were presented during the oral hearing. The plaintiffs' primary concern is to be able to present their arguments again regarding the legal assessment of the defendant's submissions. However, the right to be heard does not entitle the plaintiffs to a comprehensive and detailed discussion of all factual or legal aspects during the oral hearing, nor does it entitle them to an explicit ruling on all arguments. 23 The action is unsuccessful. 24 The sole subject matter of the action is the factual situation underlying the statement of claim dated May 9, 2024, which is the subject of the contested appeal decision of April 12, 2024. 25 The defendant did not consent, pursuant to Section 91 of the Code of Administrative Court Procedure (VwGO), to the inclusion of the further data processing and data transfer operations in the period from 2023 to 2025, as requested by the plaintiffs in their brief of May 3, 2026. An amendment to the action in the form of an expansion of the claim is also not expedient. Expediency requires that the subject matter of the dispute remains essentially the same or that – in the case of new subject matter – the result of the previous proceedings can be used. This is not the case here. The starting point for the further data protection violations alleged by the plaintiffs may indeed be the proceedings that arose in connection with the shoreline protection and the jetty. Nevertheless, these are different data processing operations and thus new subject matter of the dispute, detached from the original subject of the complaint and not related to the previous proceedings. Contrary to what the plaintiffs apparently believe, the data processing by the K. district is generally not the subject of the complaint. Moreover, unlike the new submissions, the present legal dispute was already ready for a decision. 26 The claim in point 1 is admissible, in particular as an action for performance pursuant to Section 42 Paragraph 1 Alternative 2 of the Code of Administrative Court Procedure (VwGO). The different decision on their complaint sought by the plaintiffs constitutes an administrative act within the meaning of Section 35 Sentence 1 of the North Rhine-Westphalia Administrative Procedure Act (VwVfG NRW). 27 However, the action is unfounded. The decision of April 12, 2024, is lawful and does not infringe upon the plaintiffs' rights. The plaintiffs have no right to a new decision on their appeal of September 29, 2023, against the defendant, taking into account the court's legal opinion (Section 113 Paragraph 5 Sentence 2 of the Administrative Court Procedure Act). 28 The legal basis for the contested appeal decision is Article 57 Paragraph 1 Letter f GDPR in conjunction with Article 77 Paragraph 1 GDPR. 29 According to Article 77 Paragraph 1 GDPR, every data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to them infringes data protection regulations. As the data protection supervisory authority, the LDI NRW must, within its jurisdiction, address the complaint, investigate the subject matter of the complaint to a reasonable extent, and inform the complainant within a reasonable timeframe of the progress and outcome of the investigation (Article 57 Paragraph 1 Letter f GDPR). 30 The right to lodge a complaint under Article 57(1)(f) GDPR in conjunction with Article 77(1) GDPR is a subjective public right, giving rise to a judicially reviewable, two-stage claim. 31 First, it must be examined whether the supervisory authority has adequately investigated whether an infringement of the General Data Protection Regulation (GDPR) has occurred. If an infringement is found, the complainant has a right to a decision on supervisory action by the supervisory authority that is free from errors of discretion. 32 See CJEU, Judgment of 7 December 2023 - C-26/22 - , juris para. 56 et seq. 33 Article 57 GDPR does not specify what scope of investigation is to be considered "adequate" in the context of the principle of official investigation when processing a complaint. Recital 141, second sentence, of the GDPR stipulates that the investigation, subject to judicial review, should go as far as is appropriate in the individual case. The scope of the investigation is determined, in particular, by the individual significance of the matter and the seriousness of the alleged infringement. The supervisory authority has discretion in this regard. 34 Federal Fiscal Court (BFH), Judgment of December 12, 2023 - IX R 33/21 - , juris para. 30. 35 Based on this, the judicial review of the appeal decision is governed by Section 114(1) of the Code of Administrative Court Procedure (VwGO). 36 Applying this standard, no errors of discretion are apparent in the defendant's decision that a data protection infringement could not be established. The defendant recognized and exercised its discretion regarding the scope of the investigation. The defendant fulfilled its obligations under Article 57(1)(f) GDPR in processing the plaintiffs' complaint. She took note of the facts arising from the plaintiffs' submissions in conjunction with the statement of the data protection officer of the K. district dated September 19, 2023, examined them to a reasonable extent, and subsequently reviewed and assessed them with regard to data protection law. Further clarification, in particular by obtaining the file of the K. district, was not warranted. 37 The defendant fully grasped the content of the plaintiffs' complaint. In their letter of September 29, 2023, the plaintiffs set out, in six points of complaint, the facts substantiated by facts and specifically relating to the case file held by the K. district under file number 66.32.10-A5/2020-1/2023. The statement of the data protection officer of the K. district dated September 19, 2023, was attached to the complaint. This statement refers to the plaintiffs' complaint filed there on September 6, 2023, with the same points of complaint. In his letter, the data protection officer addresses each of the alleged legal violations and provides supplementary factual information in addition to the legal assessment. While the plaintiffs do not share the legal opinion of the K. district, they do not dispute the facts presented. Insofar as they object in their complaint to the defendant that the email on page 9 of the Lower Water Authority's file mentions three individuals, while the data protection officer refers to only two, the plaintiffs have clearly not read the statement correctly. It refers to employees of the K. district – in the plural – who were informed, in addition to the employee of the L. am See civil engineering office. This provided the defendant with a sufficiently reliable factual basis for its investigation. 38 Since the plaintiffs have presented neither supplementary nor differing factual arguments, further investigations by the defendant were not warranted. The defendant expressly gave them the opportunity, by letter dated January 29, 2024, to provide further information regarding the facts of the case. She also indicated that she might request the District of K. to submit the relevant file excerpts if this provided sufficient evidence that the file did not yet contain relevant information presented by either the plaintiffs or the district. The plaintiffs did not take advantage of this opportunity but limited themselves to stating their legal position. There were also no other concrete indications that further clarification of the facts was necessary. In particular, it is not apparent that the information provided by the data protection officer of the District of K. was inaccurate. The defendant is not obligated to initiate time-consuming and resource-intensive investigations based solely on speculative findings, even at the request of the complainants. 39. There is clearly no violation by the District of K. in the processing of the plaintiffs' personal data. 40 Insofar as the plaintiffs object to the involvement of "uninvolved persons," these processing operations are not objectionable because they can be based on the legal basis for processing pursuant to Article 6(1)(e) GDPR. According to this provision, processing is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 41 The lawful processing of personal data on the basis of Article 6(1)(e) GDPR requires not only that the controller performs a task carried out in the public interest, but also that the processing of personal data for the performance of that task is based on a legal basis within the meaning of Article 6(3) GDPR. 42 See CJEU, Judgment of 20 October 2022 - C-306/21 - BeckRS 2022, 28062, para. 52; CJEU, Judgment of 2 March 2023 - C-268/21 - juris, paras. 31 et seq. 43 Insofar as data processing within the meaning of Article 6(3), second sentence, alternative 2, subparagraph 1 GDPR is necessary for the performance of a task carried out in the public interest, such a task arises from the respective provisions of the relevant sectoral law. 44 See, regarding the similar provision in Section 3 of the Federal Data Protection Act (BDSG): Federal Administrative Court, Judgment of 20 March 2024 - 6 C 8/22 - juris, para. 40. 45 In the present case, this is Section 88 of the Federal Water Act (WHG). The regulation contains, specifically for the area of water management law, the necessary legal basis for the collection, processing, and use of personal data. 46 See Appel, in: Berendes/Frenz/Müggenborg, WHG, 2nd, completely revised and significantly expanded edition, § 88 WHG para. 2 f. 47 According to § 88 para. 1 sentence 1 WHG, the competent authority may, within the scope of the tasks assigned to it by law, collect and use information, including personal data, for specific purposes in connection with water management law. These tasks include, in particular, the watercourse supervision at issue here (§ 88 para. 1 sentence 2 no. 2 WHG). 48. According to Section 100 Paragraph 1 of the Federal Water Act (WHG) in conjunction with Section 93 of the Water Act for the State of North Rhine-Westphalia (State Water Act - LWG), the task of the water supervisory authority is to monitor water bodies and the fulfillment of public-law obligations that exist under or based on provisions of this Act, regulations based on this Act, or state law. The competent authority orders, at its own discretion, the measures necessary in each individual case to prevent or eliminate impairments to the water balance or to ensure compliance with obligations under sentence 1. The district of K., as the lower water authority, is obligated to perform the task of water supervisory authority, which is in the public interest, pursuant to Section 114 Paragraph 3 of the LWG in conjunction with Section 1 Paragraphs 2 and 3 of the Ordinance on Responsibilities for Environmental Protection.49 Section 100 Paragraph 1 of the Federal Water Act (WHG) authorizes the competent authority to take action in the event of a violation of the water law obligations specified in Section 100 Paragraph 1 Sentence 1 WHG. This includes the obligation to construct structures in, on, under, and above surface waters only after obtaining prior authorization (Section 22 Paragraph 1 of the State Water Act (LWG) in conjunction with Section 36 Paragraph 1 Sentences 1 and 2 WHG). It is undisputed that this applies to the bank reinforcement and the jetty on the two riverbank properties along the D. Mühlenbach stream. The fact that these structures were erected in violation of the authorization requirement under Section 22 Paragraph 1 LWG prompted the action of the K. district as the lower water authority. 50. To clarify the facts (§ 24 VwVfG NRW), it was not only permissible but even required at this stage of the proceedings to determine responsibility for the shoreline structures. The potential addressees of a water management order include the property owners as those responsible for the condition, as well as the plaintiffs as potential perpetrators and those responsible for the condition. The owners of the affected properties are Gelsenwasser AG and the City of L. am See. The information available to the Lower Water Authority, including any personal data of the plaintiffs, had to be transmitted to them so that they could effectively defend themselves against any potential administrative order. This also applies at this stage of the proceedings even if, at the end of the official investigations, it should turn out that Gelsenwasser AG is not responsible for the condition. Furthermore, Gelsenwasser AG and the City of L. am See, or their respective employees, were permitted to participate in the site visit as potential addressees of an administrative measure. In this situation, there can be no talk of "uninvolved parties." Whether the plaintiffs gave these individuals their consent to enter their property is not a question of data protection. 51 Furthermore, the defendant correctly points out that, within the framework of watercourse supervision, all information, including the plaintiffs' personal data, could also be transmitted to the Lower Nature Conservation Authority. The nature conservation authorities must be informed during the preparation of official measures that may affect nature conservation interests, and they must be given the opportunity to comment (Section 3, Paragraph 5, Sentence 1 of the Federal Nature Conservation Act (BNatSchG)). One objective of nature conservation is to protect inland waters from impairment; this applies in particular to natural and near-natural waters, including their banks (Section 1, Paragraph 3, No. 3 BNatSchG). In the case of possible measures involving the dismantling of unauthorized structures on the embankment and riparian buffer strip of a stream, nature conservation interests are therefore affected. For the notification required under Section 3 Paragraph 5 Sentence 1 of the Federal Nature Conservation Act (BNatSchG), it is necessary that the nature conservation authority be enabled by the information to carry out a professional assessment. 52 See Heß/Wulff, in: Landmann/Rohmer, Environmental Law, 109th edition, January 2026, Section 3 BNatSchG, marginal note 42. 53 In this respect, the Lower Nature Conservation Authority had to be informed of the complete facts regarding the bank stabilization and the jetty. 54 Insofar as the plaintiffs complain that a telephone call with a woman unknown to them, Ms. C., was recorded, as well as a discussion of the facts with a lawyer without power of attorney, there is also no data protection violation. These data processing operations by the K. district are also lawful because they can be based on Article 6(1)(e) GDPR. Contrary to what the plaintiffs would have us believe with their misleading statements, they, as parties to the administrative proceedings, initiated both data processing operations themselves. The court is convinced that Ms. C. is not an uninvolved person, but rather the plaintiff herself. The plaintiffs' assertion that "this person is unknown to us" is mere hairsplitting. The plaintiff does not share the same surname as her husband. However, this does not change the fact that she herself made the call. This is clearly evident from the telephone record of February 17, 2023 (page 47 of the supplementary file, volume 7). The document states: "Ms. C. called me on February 17, 2023, at 8:04 a.m. regarding the letter she and her husband received due to the unauthorized bank reinforcement and construction of structures (here: a jetty and path) on the embankment and riparian zone of the L. stream, Mühlenbach (...)" Furthermore, an email from an employee of the K. district, dated the same day at 11:56 a.m. (page 54 of the supplementary file, volume 7), states that "the adjacent landowner (...) already contacted me today." Just two days prior, namely with notices dated February 15, 2023, the plaintiffs had been ordered to remove the unauthorized bank reinforcement as well as the constructed jetty and the path. Given this short timeframe and due to the detailed knowledge of the local conditions, an unknown third party can be ruled out as the caller. The plaintiff's response to the court's specific question during the oral hearing, that she could not recall the matter, is considered by the court, given the plaintiff's comprehensive knowledge of the facts, including the relevant data, to be a mere pretext. 55 The same applies to the lawyer's letter of April 28, 2023, and the subsequent telephone conversation. The plaintiffs insist that they "never retained" this lawyer. This, too, is mere hairsplitting. While it is true that the lawyer was ultimately not granted power of attorney, the plaintiff admitted during the oral hearing that she had contacted an assessor she knew, who worked for this lawyer, in connection with the bank reinforcement and the jetty. If the lawyer subsequently requests access to the files from the responsible authority, assuming he will be granted power of attorney, the plaintiffs must be held accountable for this, especially since it was clearly initially in their interest. The cover letter included both the exact local file number and the names of the case officers handling the case. The lawyer could only have obtained this information from the plaintiffs. 56 Finally, the plaintiffs' complaint regarding the "unencrypted transmission of personal data by email" does not violate Article 5(1)(f) GDPR. According to this principle, personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures ("integrity and confidentiality"). These measures may include, among other things, pseudonymization and encryption of personal data. 57 As a measure to ensure data security, the K. district has implemented such encryption. Messages sent by email are subject to transport encryption. There is no evidence that the emails contained particularly sensitive data that would have required special protection in the form of end-to-end encryption. 58 The decision on costs is based on Section 154 Paragraph 1 Sentence 1 of the Code of Administrative Court Procedure (VwGO). 59 The decision on provisional enforceability is based on Section 167 of the Code of Administrative Court Procedure (VwGO) in conjunction with Section 708 No. 11, Section 709 Sentence 2, and Section 711 of the Code of Civil Procedure (ZPO). 60 Instructions on appeal 61 Within one month of service of this judgment, a written application may be filed with the Administrative Court of Düsseldorf requesting that the Higher Administrative Court for the State of North Rhine-Westphalia in Münster grant leave to appeal. The application must identify the judgment being appealed. 62 The grounds for granting leave to appeal must be stated within two months of service of the judgment. The statement of grounds, insofar as it has not already been submitted with the application, must be filed in writing with the Higher Administrative Court for the State of North Rhine-Westphalia in Münster. 63 The application must be filed and substantiated by a lawyer or a professor of law at a state or state-recognized university of a Member State of the European Union, another Contracting State of the Agreement on the European Economic Area, or Switzerland, who is qualified to hold judicial office, or by a person equivalent to them, acting as authorized representative. Public authorities and legal entities under public law, including associations formed by them to fulfill public tasks, may also be represented by their own employees qualified to hold judicial office or by employees qualified to hold judicial office of other public authorities or legal entities under public law, including associations formed by them to fulfill their public tasks. Attention is drawn to the special provisions in Section 67 Paragraph 4 Sentences 7 and 8 of the Code of Administrative Court Procedure (VwGO). 64 Decision 65 The value of the subject matter of the dispute is set at €10,000 until the proceedings are separated, and at €5,000 thereafter. 66 Reasons: 67 The determination of the value in dispute is based on Section 52 Paragraph 2 of the Court Costs Act (GKG). The value set until the proceedings are separated corresponds to twice the default value in dispute because the action was brought against two defendants. 68 Instructions on Legal Remedies 69 An appeal against the determination of the value in dispute may be lodged in writing or recorded by the clerk of the court at the Düsseldorf Administrative Court within six months of the decision in the main proceedings becoming final or the proceedings otherwise being concluded. The appeal may be lodged with the Düsseldorf Administrative Court within six months of the date on which the decision in the main proceedings became final or the proceedings were otherwise concluded. The Higher Administrative Court for the State of North Rhine-Westphalia in Münster shall decide on the appeal if the Administrative Court does not grant relief. If the value in dispute was determined less than one month before the expiry of the aforementioned period, the appeal may be lodged within one month of service or informal notification of the order determining the value in dispute. The appeal is only admissible if the value of the subject matter of the appeal exceeds two hundred euros in legal disputes that were pending before January 1, 2026, and three hundred euros in legal disputes that were pending on or after January 1, 2026. The appeal is also admissible if the court that issued the decision allows it because of the fundamental importance of the question at issue.

Similar Content