LG Erfurt - 8 O 1280/21

LG Erfurt - 8 O 1280/21
Court:	LG Erfurt (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 12 GDPR Article 15 GDPR Article 23 GDPR
Decided:	07.07.2022
Published:
Parties:
National Case Number/Name:	8 O 1280/21
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	OpenJur (in German)
Initial Contributor:	Sara Horvat

The Regional Court of Erfurt (LG Erfurt) requested a preliminary ruling by the CJEU on, among others, the question whether making an access request for purposes unrelated to data protection would be an abuse of rights.

English Summary

Facts

The data subject had lost his insurance certificates. He therefore sent an access request under Article 15(1) GDPR to the insurance provider (the controller) to obtain them.

Holding

The Regional Court of Erfurt (LG Erfurt) held that the question of whether Article 15 GDPR may be used for non-data protection-related requests or whether it is an abuse of rights is controversial and the case law is not consistent on the matter. Therefore, it requested a preliminary ruling from the CJEU on the following questions:

1. Is Article 15(3) GDPR in conjunction with Article 12(5) GDPR to be interpreted to the effect that the controller is not obliged to provide the data subject a first copy of his personal data processed by the controller free of charge if the data subject does not request it for purposes referred to in the first sentence of recital 63 to the GDPR (namely to become aware of the processing of his personal data and to be able to check its lawfulness) but instead pursues another - non-data protection-related but legitimate - purpose?

2. If the answer to question 1 is no:

a) Can a national provision of a Member State which was adopted before the entry into force of the GDPR be considered as a restriction on the right to a free copy of the personal data processed by the controller under Article 23(1) GDPR?

b) If the answer to question 2a is in the affirmative: Is Article 23(1) GDPR to be interpreted as meaning that the rights and freedoms of other persons referred to therein also include their interest in being relieved of the costs associated with the provision of a copy of data pursuant to the first sentence of Article 15(3) GDPR and other expenses caused by the provision of the copy?

c) If the answer to question 2b is affirmative: In the doctor-patient relationship, does the provision of a copy of the patient's personal data from the patient's file always and irrespective of the specific circumstances of the individual case give the doctor a right to charge the patient a fee for the associated costs?

3. if question 1 is answered in the negative and questions 2a, 2b or 2c are answered in the negative: Does a claim under Article 15(3) GDPR in the doctor-patient relationship include a claim for the provision of copies of all parts of the patient's file containing the patient's personal data or is it only directed at the provision of a copy of the patient's personal data as such, leaving the way of compilation of the patient's data up to the data processing doctor?"

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

tenor

It is intended to stay the legal dispute and to make a referral to the Court of Justice of the European Union in accordance with Art. 267 TFEU.

This is based on the following considerations:
reasons

1. In the meantime, the plaintiff has sufficiently explained, by submitting a declaration of loss, that he has lost the requested insurance certificates, supplements to insurance certificates and supplementary sheets from the years 2011 to 2017 and 2020. They can no longer be found.

2. The admissibility of the filed action can currently be left open. In any case, according to the prevailing opinion, the assertion of a right to information is permissible and admissible.

3. Since there are no other grounds for a claim, only a right to information under Art. 15 GDPR can be considered. As is well known, the question of whether the asserted provision of information results from the General Data Protection Regulation is controversial. The case law of the Supreme Court diverges. This applies above all to the question of whether the use of Art. 15 GDPR for "data protection-related" concerns is abusive or not.

The statements of the Cologne Higher Regional Court are convincing (judgment of May 13, 2022 - 20 U 198/21 -, paras. 69 - 72, 86 ff., juris):

"However, the right to information arises - which the regional court correctly assumed - from Art. 15 Para. 1, 3 DS-GVO.

According to Art. 15 Para. 1 DS-GVO, every data subject, i.e. according to Art. 4 No. 1 DS-GVO every person who can be identified or identified by personal data, has the right to request confirmation from the person responsible as to whether they are concerned personal data are processed; if this is the case, it has i.a. a right to information about this personal data. According to Art. 15 Para. 3 DS-GVO, the person responsible must provide a copy of the personal data that are the subject of the processing.

The term "personal data" according to Art. 4 DS-GVO is broadly defined (BGH, judgment of June 15th, 2021, Az. VI ZR 576/19 - quoted from juris; cf. also our judgment of July 26th, 2019 in of the matter 20 U 75/18). In particular, it is not limited to sensitive or private information, but potentially includes all types of information of both an objective and subjective nature, provided that it is information about the person in question (BGH, judgment of June 15, 2021, Az VI ZR 576/19 - quoted from juris). The latter requirement is met if the information is linked to a specific person due to its content, purpose or effects (Federal Court of Justice, judgment of June 15, 2021, Az. VI ZR 576/19 - quoted from juris). It is not necessary for it to be "significant biographical information" that is "in the foreground" of the document in question (BGH, judgment of June 15, 2021, Az. VI ZR 576/19 - quoted from juris).

As part of its judgment of June 15, 2021 (Az. VI ZR 576/19 - quoted according to juris), the BGH expressly clarified that in particular neither data from the insurance certificate nor the past correspondence between the policyholder and the insurer are categorically different from the application report of Art. 15 DS- GMOs are excluded. The letters from the insurer to the policyholder should be subject to the right to information insofar as they contain information about the policyholder according to the criteria presented.

The assertion of a right to information based on Art. 15 DS-GVO in cases like the present one is not to be evaluated as abusive of rights, § 242 BGB.

It is correct that the data subject's right to information regarding the personal data concerning them serves the purpose of being aware of the processing and being able to check its legality (cf. recital 63 of the GDPR). It may be assumed that the plaintiff in the present case is ultimately not concerned, at least not primarily, with the protection of her data, but with the preparation of pecuniary claims. However, this does not prevent the assertion of a right to information based on Art. 15 DS-GVO. In particular, the same cannot be inferred from the decision of the Federal Court of Justice of June 15, 2021 (Az. VI ZR 576/19). A specification as to whether a right to information under data protection law also exists if a policyholder is pursuing purposes that are not protected by Art. 15 (1) GDPR has not been made there.

The question is controversial in case law and literature.

The Munich Higher Regional Court (indicative decision of November 24th, 2021, Az. 14 U 6205/21; so both in the result and in the reasoning also Hamm Higher Regional Court, decision of November 15th, 2021, Az. 20 U 269/21) has a right to information in a similar case (also) rejected on the grounds that the meaning and purpose of Art. 15 Para Enabling the assertion of pecuniary claims if he has not kept his documents.

In the opinion of the Senate, however, a corresponding teleological restriction should not be made (cf. already the judgment of July 26, 2019 in Case 20 U 75/18). From the fact that the purpose of Art. 15 DS-GVO is to ensure the legality of the processing of personal data and to enable the data subject to enforce the rights provided for in the DS-GVO, it does not necessarily follow that the claim also only for this purpose may be exercised. Rather, the Senate shares Bäcker's view, which he found convincing (in: Kühling/Buchner, DS-GVO BDSG, 3rd edition 2020, Art. 15, para. 42d; also Bäume, r+s 2021, 98; Schmidt-Wudy in: BeckOK data protection law, 39th edition, as of November 1st, 2021, Art, 15 para. 85 ff. with further references), who explains that the function of Art. 15 DS-GVO is not limited to such internal data protection use of the information obtained. Rather, the purpose of the regulation as a whole is to protect the rights and freedoms of the person against impairments and threats caused by the processing of personal data. If the data subject uses their right to a copy of their data in order to reduce information asymmetries between themselves and the person responsible and thus protect their rights and freedoms, this is a legitimate and legally recognized goal. It does not matter whether these rights and freedoms are themselves anchored in data protection law or in another subset of the law. A request for a copy, for example, with which the person concerned wants to obtain information for the preparation of court proceedings against the person responsible in which they want to assert claims outside of data protection, is therefore harmless and must be fulfilled in principle.

It should also be noted that, in the opinion of the Senate, it can hardly ever be ruled out that policyholders are at least concerned about the protection of their data. Against this background, too, it does not appear sensible to make the existence of the right to information under the GDPR dependent on a corresponding - non-verifiable - assertion about the internal motivation of the respective claimant.

Based on this, the defendant is also not entitled to refuse the information according to Art. 12 Para. 5 S. 2 DS-GVO. Because the application is not just excessive because the plaintiff is not primarily concerned with protecting her rights under the GDPR. There is also no evidence of harassment or a request for information that is repeated at inappropriately short intervals. Whether the defendant's request to make it more difficult for the policyholder to check the legality of the premium claims made by him by not handing over stored documents is worthy of protection against the background of contractual duties of care may be left open."

4. It seems sensible and necessary to give the Luxembourg Court of Justice, which in any case has the last word, the opportunity to provide timely assistance.

A few manageable questions should be asked about the interpretation of Art. 15 GDPR. A further clarification of the term "personal data" does not appear necessary. It is not primarily a problem of interpretation, but rather the mere application of the law incumbent on the national courts - as Union courts - ("application").

5. The current ECJ submission of the Federal Court of Justice from March, which concerns a comparable problem (BGH, ECJ submission of March 29, 2022 - VI ZR 1352/20 -, juris), provides orientation:

"1. Is Art. 15 Para. 3 Sentence 1 in conjunction with Art. 12 Para to make his personal data processed by the person responsible available free of charge if the person concerned does not request the copy in order to pursue the purposes stated in recital 63 sentence 1 of the GDPR, to become aware of the processing of his personal data and to be able to check its legality, but pursues another - non-data protection but legitimate - purpose (here: the examination of the existence of claims under medical liability law)?

2. If question 1 is answered in the negative:

a) If the right resulting from Article 15 (3) sentence 1 in conjunction with Article 12 (5) GDPR is restricted to free provision of a copy of the personal data processed by the person responsible pursuant to Article 23 (1) (i). DS-GVO also a national regulation of a member state that was enacted before the entry into force of the General Data Protection Regulation?

b) If question 2a is answered in the affirmative: Is Art. 23 Para. 1 Letter i DS-GVO to be interpreted in such a way that the rights and freedoms of other persons mentioned there also include their interest in the relief from the granting of a data copy according to Art. 15 3 sentence 1 DS-GVO and other expenses caused by the provision of the copy?

c) If question 2b is answered in the affirmative: occurs as a restriction of the obligations and rights resulting from Article 15 (3) sentence 1 in conjunction with Article 12 (5) GDPR under Article 23 (1) (i) GDPR Consider a national rule which, in the doctor-patient relationship, provides for a reimbursement claim by the doctor against the patient whenever the doctor hands over a copy of the patient's personal data from the patient's file to the patient, regardless of the specific circumstances of the individual case?

3. If question 1 is answered in the negative and questions 2a, 2b or 2c are answered in the negative: Does the right under Art. 15 Para. 3 Sentence 1 DS-GVO in the doctor-patient relationship include a right to the transfer of copies of all the personal data of the parts of the patient's file containing the patient, or is it only aimed at issuing a copy of the patient's personal data as such, leaving it up to the doctor processing the data to decide how he compiles the data for the patient concerned?"

6. Finally, it is pointed out that a referral in the present proceedings gives both sides the opportunity to influence the case law of the Court of Justice with their own opinions. Otherwise this would not be possible, so that the results of the ECJ submission by the BGH would simply have to be accepted.

There is an opportunity to respond to these notes or the intended ECJ submission by August 5th of this year. to comment, if necessary to submit proposals for questions to the Court of Justice.
Permalink: https://openjur.de/u/2446855.html (https://oj.is/2446855)
full text
print view
Download PDF
Quotes4
Cited0
References0
keywords