In case of targeted search for infringements, warning notice due to transfer of IP address to the USA inadmissible.
Baden-Baden Regional Court, judgement of 16 January 2023 – 3 O 277/22. In this judgement, the court had to decide whether a warning notice in connection with the payment of damages for pain and suffering due to the transfer of an IP address to a server in the USA was admissible after a targeted search for the infringement in the form of a violation of the General Data Protection Regulation.
The plaintiff operates a centralised franchise system. On its website and the pages of the franchisees, the plaintiff is named as the responsible party in the imprint. Google Fonts” is used on the website. When calling up the website, the IP address is automatically transmitted to a Google server in the USA. The transfer to the USA can be prevented by changing the data processing settings to “local”. The plaintiff had arranged for this on all of the franchisees’ websites. Only on the content-empty subdomains that had not yet been used was this change not made.
With the help of a computer program that uses a certain algorithm, the defendant came across these content-empty subdomains, on which the IP address of the website visitors was transmitted to the server in the USA via “Google Fonts”. The defendant then had his lawyer send out warnings in which he asserted a claim for damages for pain and suffering pursuant to Article 82 of the GDPR and a claim for injunctive relief due to violation of the general right of personality (Section 823 (1) of the German Civil Code (BGB)) and offered to refrain from further measures in exchange for a payment of 170 euros.
The plaintiff is of the opinion that the defendant interferes with the plaintiff’s right to its established and practised business and that it is therefore entitled to an injunction against the warning. The defendant is not entitled to damages for pain and suffering under Article 82 of the GDPR and therefore the warnings are unjustified. Since the defendant had hoped that the IP address would be transferred to the USA when calling up the internet pages, he had impliedly consented to the transfer of the data and the necessary legal basis for the data processing was given. There was no breach of data protection.
The defendant takes the view that this is not an abusive warning. He did not act with the intention of generating income for himself. Rather, he wanted to support Google’s monitoring, which in his opinion was being neglected.
The court agrees with the plaintiff’s view. The defendant was not entitled to damages for pain and suffering pursuant to Art. 82 GDPR. By accessing the websites, the defendant had consented to the processing there. His primary interest was to obtain compensation for pain and suffering. The subject already mentioned a warning – in the court’s view, the focus was on the payment of a sum of money. The business model could only work if the IP address was transferred to the USA in accordance with his wishes. The consent therefore refers to the data processing in the sense of the transfer to the USA.