Decision of the OLG Frankfurt a.M.: Requirement to provide email address or mobile number when purchasing train tickets is not lawful
The Higher Regional Court Frankfurt am Main addressed a question significant to data protection in the online ticket sales of Deutsche Bahn. The subject of the case was the practice of mandatorily requiring an email address or mobile phone number when purchasing an online ticket. The court deemed this approach unacceptable and declared the associated compulsion to be inadmissible (OLG Frankfurt a.M., judgment of 30.05.2024, ref.: 6 U 49/23, with an appeal pending – status: June 2024. Source: juraforum.de).
Background of the proceedings
With the advancing trend of digitalization, personal data is systematically collected and processed by Deutsche Bahn AG when purchasing tickets. In particular, creating an account has been required for some time when completing online ticket purchases, which mandates providing at least an email address or alternatively a mobile phone number. Buying tickets without disclosing such contact details was not possible.
A consumer protection association challenged this practice. It was particularly criticized that such data collection occurred without adequate legal grounds and represented an unreasonable disadvantage to consumers.
Legal assessment by the OLG Frankfurt a.M.
Requirements of the General Data Protection Regulation (GDPR)
The collection of personal data such as email addresses and mobile numbers is subject to the strict provisions of the GDPR. According to Art. 6 Para. 1 GDPR, data can generally only be processed if necessary for fulfilling a contract or if the data subject consents. OLG Frankfurt a.M. emphasized the necessity for achieving the purpose and the need to limit data collection to the absolutely necessary (principle of data minimization according to Art. 5 Para. 1 lit. c GDPR).
Email address and mobile number not mandatory for ticket purchase
The OLG argued that for the mere purchase and inspection of tickets, neither an email address nor a mobile number is fundamentally necessary. Even the provision of tickets in paper form or directly online is technically possible without forcibly requiring contact information to be disclosed. The necessity of data collection was particularly scrutinized concerning alternative ticket delivery and inspection methods.
A legitimate interest of Deutsche Bahn AG in general data use was not recognized in this context. Instead, ticket purchases should also be possible anonymously or with minimal contact data use.
Unlawfulness of linking ticket delivery to contact information
The compulsion to provide contact information was also deemed unlawful under consumer protection aspects. The OLG clarified that linking ticket purchases to unnecessary data provision regarding data protection is not compatible with current laws. This also particularly applies to the exclusion of alternative purchasing and delivery methods.
Significance for companies in ticket sales and for consumers
Implications for digital business models
The judgment of the OLG Frankfurt a.M. has far-reaching implications for companies operating online sales models with mandatory registration and provision of communication data. The decision highlights that companies must carefully scrutinize data protection requirements and align their business processes with the principles of data minimization and proportionality.
Higher demands on the design of online services
It should be noted that consumers should retain control over their personal data, and covert or blanket data collection without a justifiable reason is not accepted. Innovative sales channels like online ticket shops are therefore subject to heightened data protection sensitivity.
No legal finality – Further developments remain to be seen
It should be emphasized that the judgment has been appealed before the Federal Court of Justice. The final legal clarification is therefore still pending. Until a final decision is made, the presumption of innocence applies regarding the disputed company practice. Further developments will be closely monitored by companies and consumers alike.
Relevance for corporate data processing
For business actors and institutional investors, the decision signals the need to regularly evaluate the compliance of existing data processing procedures and align them with the current legal situation and case law in the area of data protection. Simultaneously, the judgment illustrates that designing contractual processes must always be balanced between business needs and the rights of those affected.
Further questions on the data protection-compliant design of e-commerce and digital ticket solutions or the integration of alternative communication channels are subjects of ongoing legal development. Companies and organizations benefit from expert assessment, especially in the international context and regarding sector-specific peculiarities. For a deeper legal evaluation and individual scrutiny, consulting with law firms experienced in data protection law is recommended – among others, MTR Legal offers well-founded support in legal advice on data protection and assists clients in implementing their business models compliantly.
