Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Baden-Württemberg: Public Procurement Chamber's decision rendering use of EU subsidiary of US group unlawful overturned

The Karlsruhe Higher Regional Court ('the Court') issued, on 7 September 2022, its decision in Case No. 15 Verg 8/22, in which it overturned a lower court's decision, namely, the Public Procurement Chamber's decision of 13 July 2022, to reject an unsuccessful bidder's request for review of the tender award, following an appeal on the same. 

Background to the case

In particular, the Court stated that, at the request of an unsuccessful bidder in a procurement procedure for a review of the tender award, the lower court had decided that the successful bidder should be excluded from the procurement process due to its violation of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), which rendered the bid incompatible with the requirements of the tender documents. In this regard, the Court further noted that such a decision was made since the lower court considered that the successful bidder's use of a Luxembourg subsidiary of a US group as a service provider in its bid gave rise to the possibility that personal data can be accessed by the US parent company, leading to a 'transfer' within the meaning of the GDPR, regardless of whether the US parent company actually accesses the personal data. 

Findings of the Court

Notably, the Court upheld the appeal lodged against the lower court's decision and found that since the successful bidder had made clear assurances about the content of the contract between it and the Luxembourg service provider, which iterated that data may only be transmitted to the Luxembourg subsidiary, processed solely by it without exception, and processed only in Germany, it could be assumed that the bidder will fulfil the contractual commitments specified. As such, the Court explained that it should not be assumed that due to the group affiliation tying the subsidiary to the US, the subsidiary would receive or follow illegal instructions from the US parent company. Consequently, the Court noted that the bid had not deviated from the data protection and IT security requirements specified in the tender and that therefore there was no reason to exclude the successful bidder's offer from the award procedure. 


Ultimately, the Court overturned the lower court's decision and rejected the application to exclude the successful bidder's offer from the award procedure. In this regard, the Court noted that its decision is final. 

You can read the press release, only available in German, here.