Made in accordance with Article 3(5) of the Statute of the European Ombudsman[1]

The background to the complaint

1. On 19 February 2010, the complainant complained to the European Commission that Germany had not properly implemented Directive 2002/58 on privacy and electronic communications (the Directive)[2]. In particular, he argued, firstly, that the German legislation (the Telekommunikationsgesetz (TKG) and the Telemediengesetz (TMG) did not provide for as far-ranging a duty to inform users of the data stored in relation to them as the Directive did. Secondly, the TKG allowed data to be stored generally, not only exceptionally, and thus breached Article 15(1) of the Directive, which provides that any legislative measure restricting the scope of the rights and obligations provided for in the Directive must constitute "a necessary, appropriate and proportionate measure within a democratic society". Thirdly, the Directive only allowed companies to send electronic marketing e-mails if they had obtained the e-mail address in the context of the sale of a product or a service, and only in order to market their own similar products (unless the customer had given consent). The TKG, by contrast, appeared to be too permissive in that regard.

2. The complaint was registered as an infringement complaint by the Commission.

3. In a letter of 31 January 2011, the Commission's Directorate-General for Information Society and Media informed the complainant that the Commission intended to close the case. In relation to the first aspect of the complaint, namely, the complainant's argument that the storage of data or access to information saved on a device was not conditional on having informed the user of this possibility, the Commission considered that Germany had implemented the Directive in an appropriate manner. It explained that Article 13 of the TMG provided that a user had to be informed about the manner and purpose of any collection and processing of his personal data. The definition of personal data provided by the German data protection law (the Bundesdatenschutzgesetz - BDSG) was sufficiently broad, and the combination of the TMG and the BDSG ensured adequate protection.

4. In relation to the second aspect of the complainant's infringement complaint (on the storage of data), the German government had informed the Commission that Article 100(3), second sentence, of the TKG did not grant an independent right to store data, but in fact related to the processing of data in order to combat abuse, based on the principle of necessity. The Commission pointed out that Article 4 of the Directive required electronic communications providers to take measures to ensure the security of the service, and that recital 29 allowed them to process data necessary for billing and in order to discover and put an end to any abusive use of the services without payment.

5. Finally, in relation to the third aspect of the complainant's infringement complaint (on e-mail marketing rules), the Commission referred to Article 7 of the German law against unfair competition (Gesetz gegen unlauteren Wettbewerb - UWG), and stated that that Article provided for e-mail marketing to be limited only to e-mail addresses obtained in the context of the sale of a product or service and only to clients expressly informed that they could object to the use of their e-mail addresses. It noted that that Article also required that only own similar products be marketed.

6. The Commission's Directorate-General for Information Society and Media concluded that it thus did not intend to propose to the Commission to commence infringement proceedings. Instead, it would propose that the case be closed unless the complainant transmitted, within the next four weeks, any further information capable of persuading the Commission to continue the inquiry.

7. On 2 February 2011, the complainant wrote to the Commission asking it to send him the opinion submitted by the German government, in order to enable him to comment on it. He also made the following comments on the three aspects dealt with by the Commission in its letter of 31 January 2011 (the "pre-closure letter"). As regards the first aspect of his infringement complaint, he maintained his view that Article 5(3) of the Directive had not been correctly transposed. He noted that it was true that the TMG provided for a duty to inform a data subject. However, he pointed out that, while under the Directive, the consequence of a failure fully to inform the user was that the data could not validly be stored, there was no such sanction in the TMG. In relation to the second aspect, he pointed out that Article 4 of the Directive was not a legal basis for processing traffic data, as this was dealt with conclusively in Article 6. In any event, a recital could not be considered to be a legal basis for such processing beyond the duration of the connection. Moreover, recital 29 of the Directive was limited to "traffic data necessary for billing purposes" and provided for an exception; the same could not be said of Article 100(3) of the TKG. Finally in relation to the third aspect, he argued that the UWG did not apply in the context of the TKG because the latter was a more specific piece of legislation. Furthermore, if Article 7 UWG were given precedence, that would mean that Article 95(2), second sentence, of the TGK would be superfluous. This could not have been the legislator's intention. In any event, that Article provided that a service provider could use data if its conditions were fulfilled. This also showed that Article 7 UWG was not relevant here.

8. The complainant concluded that he hoped the Commission would continue its investigation, also in view of the fact that Germany was revising the relevant legislation at that time.

9. On 18 April 2011, the Commission replied, informing the complainant that the case had been closed on 7 April 2011. The additional arguments he had made in his most recent e-mail had not provided any new facts which could have led the Commission to reconsider its position. As the complainant had also shown an interest in the opinion of the German government in the matter, the Commission provided him with the contact details of the relevant official in the German ministry concerned. Shortly thereafter, the complainant turned to the Ombudsman.

The subject matter of the inquiry

10. The Ombudsman opened an inquiry into the following allegation and claim.

Allegation

The Commission failed properly to handle the complainant's infringement complaint of 19 February 2010.

In support of this allegation, the complainant agued that the Commission failed properly to reason its decision in this regard, in particular by failing to comment on the arguments raised in his letter dated 2 February 2011.

Claim

The Commission should either commence infringement proceedings against Germany or provide sufficient reasons for its decision not to do so.

11. The complainant also alleged that the Commission had not properly handled his request for access to the opinion submitted by Germany. It should have dealt with his request under Regulation 1049/2001, and could not simply refer him to the relevant German ministry. He thus claimed that the Commission should apply Regulation 1049/2001 and grant him access to the document.

12. The Ombudsman decided that this allegation and claim were inadmissible because the complainant had not yet taken all the steps required by Regulation 1049/2001. On 8 July 2011, the complainant informed the Ombudsman that this aspect of his complaint had in any event been settled since the Commission had sent him the document. However, he underlined that he maintained the remainder of his complaint.

The inquiry

13. The complaint was submitted on 26 April 2011. On 6 June 2011, the Ombudsman opened an inquiry and asked the Commission for an opinion on the complaint.

14. The Commission submitted its opinion on 26 October 2011. It was forwarded to the complainant with an invitation to submit observations, which he sent on 28 October 2011.

The Ombudsman's analysis and provisional conclusions

A. Allegation of failure to handle the complainant's infringement complaint properly and related claim

Arguments presented to the Ombudsman

15. In his complaint, the complainant expressed his dissatisfaction with the handling of his infringement complaint, in particular with the Commission's letter of 18 April 2011. He argued that the very short explanation set out in that letter was neither sufficient nor comprehensible. The Commission should have replied to each of his arguments in detail rather than providing an overall reply. The complainant also considered that, had the Commission carefully analysed his submissions, it would have decided to commence infringement proceedings in this matter. He referred to the Ombudsman's decision in case 2651/2009/(MAM)ANA, which stated that an infringement complaint had to be analysed carefully, and that the Commission had to communicate to the complainant its intention to close the case. In his view, this included a duty to assess carefully any reply that a complainant sends to the Commission following its letter informing the complainant of its intention not to pursue the infringement complaint.

16. In its opinion, the Commission first underlined that it had provided a summary of its analysis in its pre-closure letter. Therein it had concluded that the TMG adequately transposed Article 5(3) of the Directive. Article 12 of the TMG stated that personal data could only be processed with the user's consent or if processing was required by law, and Article 13 of the TMG provided that users have to be informed about the type, scope and purpose of the processing of their data. As regards Article 100 of the TKG, which allowed the retention of connection data for up to six months, the Commission had also found in its pre-closure letter that this was not in breach of the Directive. Even though Article 6(1) of the Directive stated that traffic data must be erased or made anonymous as soon as it was no longer needed for the purpose of the transmission of communication, Article 4 obliged providers to ensure the security of their services, and recital 29 allowed them to keep traffic data for the purposes of billing and preventing fraud. Finally, as regards the transposition of Article 13(2) of the Directive, the Commission had concluded in its pre-closure letter that the UWG imposed the obligations provided for in this Article. It had therefore decided not to commence any infringement proceedings.

17. When the complainant sent his e-mail of 2 February 2011 to the Commission, its services assessed his arguments in detail, in order to determine whether it should review its initial position.

18. In relation to the complainant's argument that, under German law, the processing of data was permitted even if the user had not been informed, the Commission considered that the processing of personal data was subject to the same information requirement as the storage of and access to information held on the user's device, which the Commission had already addressed in its pre-closure letter.

19. As regards the complainant's view that the Commission's reference to Article 4 and recital 29 of the Directive was not sufficient to justify the retention of connection data for up to six months, the Commission underlined that this had already been raised in the complainant's original complaint, and thus dealt with in its pre-closure letter.

20. Finally, the Commission stated that the complainant's view, namely, that Article 95 of the TKG allowed providers to send commercial e-mails under conditions that were less restrictive than those of the UWG, was based on what was merely his personal interpretation of the law. The Commission had considered this interpretation in its initial assessment, but did not agree with it. Therefore, this argument, too, was not new.

21. In conclusion, the complainant had not submitted any new elements which could have led the Commission to provide him with additional explanations or to reconsider its position. The Commission underlined that, in accordance with established case-law[3], it enjoyed a large discretion as to whether to commence infringement proceedings and bring an action before the Court, which did not "leav[e] any room for third party interference"[4].

22. In his observations, the complainant expressed his dissatisfaction with the Commission's opinion and maintained that the Commission had not sufficiently reasoned its decision to reject his infringement complaint. In particular, the Commission had not addressed his argument that there was no sanction if the user was not properly informed, even though this was required under the Directive. Similarly, it had not addressed his argument, in relation to the second aspect, that a recital could not be relied upon to justify limitations of fundamental rights and that Article 6 conclusively determined the question of the processing of connection data, which was why Article 4 could not be relied upon. According to the complainant, the Commission also did not address the fact that recital 29 was limited to individual cases, whereas the German legislation was not.

23. The complainant added that he had raised a number of new issues in an e-mail sent to the Commission on 25 May 2011, which the Commission failed to mention in its opinion, and in which he had asked it to reopen the case. More specifically, the complainant pointed out that he had drawn the Commission's attention to the fact that, as regards the first aspect of his complaint, the deadline for the implementation of the new version of Article 5(3) of the Directive had already expired, without Germany having adopted any transposition measures[5]. As regards the second aspect, the complainant had referred to a judgment of the German Bundesgerichtshof which confirmed his views. Similarly, as to the third aspect of his complaint, the complainant had stressed in that e-mail that the relevant national regulatory authority had endorsed his own interpretation of the relevant rules.

The Ombudsman's preliminary assessment leading to a friendly solution proposal

24. According to well-established case law, the Commission enjoys a large discretion when deciding whether to commence infringement proceedings against a Member State. However, the Commission, like any public authority, must always have good reasons for choosing one course of action rather than another. A normal part of exercising a discretionary power is to provide an explanation of the reasons why a particular course of action has been chosen[6].

25. In contrast to the facts which gave rise to the case the complainant referred to (that is to say, complaint 2651/2009/(MAM)ANA), in the present case, the Commission clearly explained, in its pre-closure letter, why, for each of the issues raised by the complainant, it considered that there were no grounds for it to commence proceedings against Germany. It also gave the complainant the opportunity to submit new arguments within four weeks of the reception of the pre-closure letter. It is therefore clear that, at least initially, the Commission showed the required diligence in dealing with the complaint and thus complied with Article 10 of its Communication on relations with the complainant in infringement proceedings[7].

26. However, when the complainant submitted further arguments in response to the Commission's pre-closure letter, the Commission sent a very short reply, merely stating that the complainant had not submitted any "new facts" which would lead it to reconsider its analysis. The Commission did not provide any explanation or reasoning to justify this position. In the course of the present procedure, the Commission reiterated the view that the complainant's reply had not provided any new elements.

27. In that regard, the Ombudsman finds the Commission's view, that is to say, that the argument which the complainant made in his letter of 2 February 2011 with respect to the first aspect of the complaint (the duty to inform customers) was merely an elaboration of what he had already submitted in his original complaint, to be reasonable. In particular, while the complainant did not specifically refer to the lack of sanctions in his infringement complaint, he had already stated that the legality of the data retention did not depend on the provision of the relevant information to the user, which could be interpreted as referring to a lack of sanctions. The Commission's pre-closure letter did not explicitly address this point directly, but clearly acknowledged it in its summary of the complaint and then rejected it, stating that Article 5(3) of the Directive had, overall, been properly implemented by Germany. The Ombudsman notes, however, that after the complainant had submitted his complaint to the Ombudsman, he asked the Commission, in his e-mail of 25 May 2011, also to take into account the fact that Germany had not implemented the revised version of Article 5(3) of the Directive. Although this issue was not raised in the original complaint, the Ombudsman considers it appropriate to take it into account in the present case and to invite the Commission to take it into account in responding to the friendly solution proposed below.

28. As regards the second aspect (storage of data collected), the Ombudsman notes that the infringement complaint did not refer to recital 29 and Article 4 of the Directive. It was only in his reply to the pre-closure letter that the complainant explained why he considered that recital 29 and Article 4 of the Directive were not relevant to the issue at hand. The Ombudsman therefore finds the Commission's view that it had already addressed these points difficult to understand. He further notes that, in his e-mail to the Commission of 25 May 2011, the complainant referred to a judgment of the German Bundesgerichtshof which, according to him, confirmed his views. The Commission did not address this issue in its opinion.

29. Similarly, in relation to the third aspect raised by the complainant (e-mail marketing rules), the Ombudsman notes that, in his initial infringement complaint, the complainant did not address the issue of the application of the UWG. In fact, this issue was first raised by the Commission itself in its pre-closure letter. In his reply, the complainant disagreed with the Commission's view with respect to the relevance of the UWG, and set out his own arguments in this regard. Thus, as far as this aspect of the complaint is concerned, the Ombudsman does not see why the Commission considered that no new arguments had been raised by the complainant. Moreover, he notes that the Commission's explanation, that is to say, that this was "merely" the complainant's own interpretation of German law, is clearly not a sufficient argument to show that the complainant failed to provide convincing new arguments to support his own view. In this context, it should further be recalled that the complainant forwarded to the Commission, on 25 May 2011, an e-mail from the Bundesnetzagentur (Federal Network Agency, the German regulatory agency responsible for, among other things, telecommunications) that appears to support his interpretation of the relevant rules. However, the Commission did not address this further argument in its opinion.

30. The Ombudsman notes that the Commission's above-mentioned Communication lays down the procedural steps involved in rejecting an infringement complaint: the Commission first writes a "letter setting out the grounds on which it is proposing that the case be closed" (the pre-closure letter) and gives the complainant four weeks to comment upon it. If these observations do not "persuade the Commission to reconsider its position", it can then decide to close the case. The Ombudsman considers that, while a reply to such observations does not have to have the same depth as the initial letter containing the reasoning for the Commission's intention to close the case, it should at least address the observations submitted by the complainant and explain in a meaningful way why the said observations are not sufficient to persuade it to change its views. Otherwise, the request for observations would not serve any useful purpose.

31. In the present case, the Commission merely indicated, in one short sentence, that the complainant had not provided any "new facts" which could have led it to reconsider its view. The Ombudsman notes that, as shown above, aside from the fact that the Commission did not provide any reasoning as to why the complainant's arguments were not such as to justify a reconsideration of the pre-closure letter, the mere reference of the Commission to the absence of any "new facts" is not foreseen in the Communication. He therefore makes the preliminary finding that this could be an instance of maladministration. He also notes that the Commission has not used the opportunity of the present inquiry to explain more clearly the reasons for rejecting the complainant's arguments with respect to the second and third aspects of his complaint (see paragraphs 28-29, above) and to address the further arguments and evidence put forward by the complainant in his e-mail of 25 May 2011. The Ombudsman therefore makes a corresponding proposal for a friendly solution below, in accordance with Article 3(5) of the Statute of the European Ombudsman.

B. The proposal for a friendly solution

Taking into account the Ombudsman's findings, the Commission could consider addressing in more detail the arguments which the complainant submitted in response to its pre-closure letter, in particular, the further arguments and evidence put forward by the complainant in his e-mail of 25 May 2011 to the Commission.

P. Nikiforos Diamandouros

Done in Strasbourg on 29 August 2013