{"id":67802,"date":"2018-02-28T07:13:07","date_gmt":"2018-02-28T05:13:07","guid":{"rendered":"https:\/\/www.lhr-law.de\/?p=67802"},"modified":"2024-10-21T11:56:09","modified_gmt":"2024-10-21T09:56:09","slug":"paypal-must-hand-over-user-data-of-copyright-infringers-if-available","status":"publish","type":"post","link":"https:\/\/www.lhr-law.de\/en\/magazine-en\/data-protection-law\/paypal-must-hand-over-user-data-of-copyright-infringers-if-available\/","title":{"rendered":"PayPal must hand over user data of copyright infringers – if available"},"content":{"rendered":"
\"PayPal
\u00a9 daviles – fotolia.com<\/figcaption><\/figure>\n

According to a judgement by the Hamburg Regional Court, the payment provider PayPal must hand over users’ personal data to the rights holders in the event of copyright infringements.<\/em><\/p>\n

Holder of exploitation rights takes PayPal to court after unsuccessful request<\/h2>\n

In the corresponding dispute, the owner of all exploitation rights to works by the artist \u2018Max Mutzke\u2019 had discovered a collection of links on a website that enabled the download of the singer’s album \u2018Max\u2019.<\/p>\n

The operator of the website was requested to disclose the name and address of the owner of the link collection – these were not available at first, but he stated that the creator of the downloads regularly used the PayPal platform to make payments to the operator.<\/p>\n

The plaintiff then turned to the payment provider with her enquiry. However, the Luxembourg-based company refused to pass on the data in view of the banking secrecy that applies there.<\/p>\n

Regional court takes PayPal to task<\/h2>\n

However, the LG Hamburg ruled by way of preliminary injunction<\/a> on the publication of the information (LG Hamburg, Urteil vom 22.3.2017, Az. 308 O 480\/16<\/a>).<\/p>\n

The decisive standard here was \u00a7 101 UrhG<\/a>, which in principle grants the owner of Copyrights<\/a> in the event of misuse. According to Section 101 (2) No. 3 UrhG, in the case of obvious copyright infringements, there is also a right to information against a person who has provided services used for infringing activities on a commercial scale.<\/p>\n

Pursuant to Section 101 (3) No. 1 UrhG, the provider must provide information about the name and address. As the owner of the link collection had paid for it via PayPal (whereby PayPal became the service provider), the provider could be held liable as a (co-)responsible party in the opinion of the judges.<\/p>\n

Banking secrecy does not count<\/h2>\n

The alleged breach of banking secrecy cited by PayPal was also deemed not to have occurred: Under Luxembourg law, such a breach is generally excluded if the disclosure of a communication is authorised or required by or on the basis of a statutory provision. Section 101 (2) UrhG constitutes such a statutory provision.<\/p>\n

The less data there is, the less needs to be released<\/h2>\n

The case is also interesting in terms of data protection law. Already now, the Data protection law<\/a> stipulates that data may only be collected sparingly and then only transmitted if the data subject has given their consent or if there is an authorisation requirement. Even after the state enforcement measure, the interim injunction by the Hamburg Regional Court, PayPal was naturally only able to disclose what the company had collected from the user at some point.<\/p>\n

The present case thus clearly shows how important the principle of data minimisation provided for by the legislator is in practice, even at a later date, which incidentally is The application of the EU General Data Protection Regulation (GDPR) will be tightened and penalised with very high fines<\/a>.<\/p>\n

The obligation of the service provider to enable the use of telemedia and its payment anonymously or under a pseudonym, as stipulated in Section 13 (6) of the German Telemedia Act (TMG) and ridiculed by many, also significantly determines the content of any right to information, which, incidentally, may not only exist under civil law, but may also be asserted by criminal investigation authorities. This is particularly relevant, for example, in the case of Clear name requirement<\/a> on Facebook, which the Berlin Regional Court has thankfully put a stop to with a recent judgement that is not yet legally binding. We reported here:<\/p>\n