Privacy & Information Security Law Blog

On July 1, 2014, the Federal Court of Justice of Germany ruled that website operators cannot be compelled to disclose a user’s personal data to third parties in the context of civil defamation proceedings. The case is notable as it clarifies the limits Germany’s Telemedia Act places on how and when personal data can be disclosed in an online context.

The case concerned several anonymous posts on a website rating local doctors. The applicant considered these posts defamatory and applied to the court for an injunction against the website operator to cease publishing the posts. He also applied for an order compelling the website operator to disclose user data relating to these posts (e.g., account registration details, IP addresses). Although the injunction was granted by the lower court, the disclosure application ultimately was denied by Germany’s highest federal civil court.

The court held that website operators are bound by the provisions of Germany’s Telemedia Act with respect to how they process and disclose personal data relating to users. The court also found that currently there is no basis in German law to compel disclosure of user data in civil defamation proceedings and, accordingly, the Telemedia Act’s restrictions on disclosure applied in this case. The court emphasized, however, that disclosures in the context of criminal proceedings, or as otherwise permitted by the Telemedia Act, are allowed.