CJEU, judgment of 12 September 2024, C-17/22 and C-18/22, HTB Neunte Immobilien Portfolio and Ökorenta
Judge-made law as a legal obligation within the meaning of Article 6(1)(c) GDPR; requirements of clarity, foreseeability and proportionality; objective indispensability under point (b).
1 Overview
In settled case law, the German Federal Court of Justice (BGH) had recognized a right to information based on the principle of good faith under § 242 of the German Civil Code (BGB), according to which limited partners have a claim against the partnership and their fellow partners to be informed of the names and addresses of the other partners. The retail fund companies HTB Neunte Immobilien Portfolio and Ökorenta resisted actions seeking such information by relying on the GDPR. The Regional Court of Munich (Landgericht München) referred various questions to the Court of Justice concerning the interpretation of Article 6(1)(b) and (c) GDPR.
2 Headnotes
A "legal obligation" within the meaning of Article 6(1)(c) GDPR may also be based on the settled case law of a national court (paras. 67 et seq.). The condition is that the case law concerned is clear and precise, that its application is foreseeable for those subject to it, that it pursues an objective in the public interest and that it is proportionate to that objective (paras. 72 et seq., 77).
Processing is necessary for the performance of a contract within the meaning of Article 6(1)(b) GDPR only where it is objectively indispensable in order to achieve a purpose that is an integral part of the contractual obligation intended for the data subject. Mere usefulness or convenience for the controller does not suffice (paras. 42 et seq.).
3 Significance
The decision extends the concept of a "legal obligation" to institutions of judge-made law and at the same time lays down strict rule-of-law requirements as to their quality (clarity, foreseeability, public interest, proportionality). It thereby complements the case law on the requirements of precision under Article 6(3) GDPR, which had been tailored to statutory and regulatory law. In corporate and company law practice, the decision has an immediate effect on claims to information between partners that are based on unwritten ancillary contractual duties of loyalty.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, judgment of 22 June 2021, C-439/19, Latvijas Republikas Saeima ("B")
Improvement of road safety as a public interest within the meaning of Article 6(1)(e) GDPR; classification of road traffic offenses as criminal offenses within the meaning of Article 10 GDPR.
German Federal Court of Justice (BGH), order of 18 August 2020, 5 StR 175/20
Admissibility of unlawfully obtained video recordings in criminal proceedings despite an infringement of Article 6(1)(f) GDPR.