Hesse: Administrative Court of Wiesbaden issues preliminary decision prohibiting RheinMain University from using Cookiebot
The Administrative Court of Wiesbaden issued, on 6 December 2021, a press release on its preliminary decision in Case No. Az. 6 L 738 / 21, as issued on 1 December 2021, where it prohibited the RheinMain University of Applied Sciences from using Cybot A/S's consent management platform Cookiebot by Usercentrics ('Cookiebot CMP').
Background to the case
The Court noted that the subject of the summary proceedings at issue was the applicant's request to prohibit the University from integrating Cookiebot CMP on its website.
Findings of the Court
In particular, the Court found that Cookiebot CMP transfers the complete IP address of the end user to the servers of a company whose headquarters are in the U.S. Moreover, the Court held that the end user was identifiable from a combination of a key stored in the user's browser, which identified the website visitor, and the transferred full IP address. In addition, the Court argued that this constituted a transfer of personal data to a third country, outlining that the same is prohibited in view of the Court of Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('Schrems II').
Furthermore, the Court held, among other things, that the University did not ask users' consent for the transfer of data to the U.S., users were not informed about the possible risks associated with the transfer resulting from the U.S. federal law Clarifying Lawful Overseas Use of Data Act ('the Cloud Act'), and the data transfer was not necessary for the operation of the University's website.
In view of the above, the Court granted the application and prohibited the University by way of an interim injunction from integrating Cookiebot CMP on its website.
Notably, the decision was made in an interim proceeding, and, as such, does not constitute a binding judgment. More specifically, the Court outlined that the University may file an appeal within two weeks of the issuance of the decision, which the Hessian Administrative Court in Kassel would decide on.
You can read the press release, only available in German, here.
UPDATE (1 February 2022)
Administrative Court of Hesse lifts interim injunction on RheinMain University for using Cookiebot
The Hessian Administrative Court 10th Senate ('the Court') issued, on 17 January 2022, its judgment in Case No. 10 B 2486/21, where it lifted the interim injunction against the RheinMain University of Applied Sciences concerning the use of Cybot A/S's consent management platform Cookiebot by Usercentrics ('Cookiebot CMP'), following a preliminary injunction by the Administrative Court of Wiesbaden ('the Administrative Court') on the same.
Background to the case
Specifically, the Administrative Court issued, on 1 December 2021, a preliminary decision in Case No. Az. 6 L 738 / 21, where it had prohibited the University from using Cookiebot CMP on its website. In particular, the Administrative Court stated, among other things, that the Cookiebot CMP transfers the complete IP address of the end user to the servers of a company whose headquarters are in the U.S., which constituted a transfer of personal data to a third country. In addition, the Administrative Court noted that such transfer is prohibited in view of the Court of Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('Schrems II'), following which the respondents appealed against the interim injunction.
Findings of the Court
In particular, the Court held that the Administrative Court should not have issued the interim injunction because the applicant had not established a ground for an injunction under Section 123(3) of the Code of Administrative Court Procedure of 21 January 1960 as amended ('VwGO'), in conjunction with Section 920(2) of the Code of Civil Procedure of 12 September 1950 as amended ('ZPO'). In addition, the Court found that there is no ground for an order because the applicant is not dependent on the use of the respondent's website and has not made it evident that without the use of this site it would result in significant disadvantages to the applicant in accordance with Section 123(1) Sentence 2 of the VwGO.
Furthermore, the Court held that the interim injunction sought and issued in the contested order only achieves a regulation taking effect in the future. In this context, the Court specified that insofar as personal data was already collected, stored, possibly processed, and passed on in the past when the applicant accessed the defendant's website, this would not change as a result of the requested interim injunction. Consequently, the Court found that the respondent's complaints are justified and that the Administrative Court should not have issued the temporary injunction requested by the applicant.